Medium severity · published Jun 22, 2020
CVE-2019-10626
Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Rennell, Saipan, SC8180X, SDA660, SDA845, SDM429W, SDM439, SDM670, SDM710, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8009 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8017 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8098 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq4019 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq6018 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq8064 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq8074 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9207c Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10626
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
More from Apq8009 Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response
