CVE-2021-30268

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	APQ8009W, APQ8017, APQ8096AU, AQT1000, AR6003, AR8035, CSRB31024, FSM10055, FSM10056, MDM8207, MDM8215, MDM8215M, MDM8615M, MDM9150, MDM9205, MDM9206, MDM9207, MDM9215, MDM9250, MDM9310, MDM9607, MDM9615, MDM9615M, MDM9628, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA4004, QCA6174A, QCA6390, QCA6391, QCA6420, QCA6426, QCA6430, QCA6436, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584, QCA6584AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCA9367, QCA9377, QCM2290, QCM4290, QCS2290, QCS410, QCS4290, QCS603, QCS605, QCS610, QCX315, QET4101, QSW8573, Qualcomm215, SA415M, SA515M, SD 675, SD 8CX, SD205, SD210, SD429, SD460, SD480, SD660, SD662, SD665, SD675, SD678, SD690 5G, SD720G, SD730, SD750G, SD765, SD765G, SD768G, SD7c, SD845, SD850, SD855, SD865 5G, SD870, SDA429W, SDM429W, SDW2500, SDX12, SDX20, SDX24, SDX55, SDX55M, SDX65, SDXR1, SDXR2 5G, SM6225, SM6250, SM6250P, SM6375, SM7250P, SM8450, SM8450P, WCD9306, WCD9326, WCD9330, WCD9335, WCD9340, WCD9341, WCD9360, WCD9370, WCD9375, WCD9380, ...[truncated*]

References

https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletinVendor Advisory

Timeline

Published: Jan 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-302697.8Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2021-30276.5app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting CVE-2021-302707.8Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Snapdragon A CVE-2021-302717.8Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon CVE-2021-302727.8Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto, Sna CVE-2021-302737.5Possible assertion due to improper handling of IPV6 packet with invalid length in destination options header in Snapdragon Auto, Snapdragon CVE-2021-302747.8Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdra CVE-2021-302757.8Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdr CVE-2021-302767.8Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Comp CVE-2021-302785.5Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, CVE-2021-302797.8Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapd CVE-2021-30289.8git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.