High severity · published Jul 13, 2021
CVE-2021-1940
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Aqt1000 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Ar8031 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Ar8035 Firmware · Qualcomm
All versions, or not specified · source: NVD
CF
Csra6620 Firmware · Qualcomm
All versions, or not specified · source: NVD
CF
Csra6640 Firmware · Qualcomm
All versions, or not specified · source: NVD
FF
Fsm10055 Firmware · Qualcomm
All versions, or not specified · source: NVD
FF
Fsm10056 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6391 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6420 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6430 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6564 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6564a Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1940
packetstormsecurity.com
http://packetstormsecurity.com/files/172856/Qualcomm-NPU-Use-After-Free-Information-Leak.html
Patch
https://www.qualcomm.com/company/product-security/bulletins/july-2021-bulletin
More from Aqt1000 Firmware
8.6
CVE-2025-21479
Incorrect Authorization in Graphics
8.6
CVE-2025-21480
Incorrect Authorization in Graphics Windows
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.8
CVE-2023-33063
Use After Free in DSP Services
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability