High severity · published Nov 12, 2020
CVE-2020-11202
Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon…
7.8
CVSS
1.5%
EPSS
No
On KEV
Description
Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCM6125, QCS410, QCS603, QCS605, QCS610, QCS6125, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA670, SDA845, SDM640, SDM670, SDM710, SDM830, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM7125, SM7150, SM7150P, SM8150, SM8150P
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QF
Qcm6125 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs410 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs603 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs610 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs6125 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6145p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa8155 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa8155p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda640 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11202
Third Party Advisory
https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/
Exploit
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
More from Qcm6125 Firmware
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.5
CVE-2025-27038
Use After Free in Graphics
9.8
CVE-2025-21483
Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs
9.8
CVE-2023-43518
Memory corruption in video while parsing invalid mp2 clip
9.8
CVE-2023-22388
Memory Corruption in Multi-mode Call Processor while processing bit mask API