Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Qualcomm Snapdragon firmware may let apps bypass memory protection

CVE-2014-10050 · published 8 years ago
Summary

The firmware for Qualcomm Snapdragon chips (MSM8996, MSM8939, MSM8976, MSM8917, SDM845, SDM660) in Android versions before the April 5, 2018 security update can be tricked into granting access to protected memory areas. This could allow a malicious app to read or modify sensitive data stored in the device. Install the Android security update released after April 5, 2018 or update the device firmware to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm msm8996_firmware All versions
cpe:2.3:o:qualcomm:msm8996_firmware:-:*:*:*:*:*:*:*
qualcomm msm8939_firmware All versions
cpe:2.3:o:qualcomm:msm8939_firmware:-:*:*:*:*:*:*:*
qualcomm msm8976_firmware All versions
cpe:2.3:o:qualcomm:msm8976_firmware:-:*:*:*:*:*:*:*
qualcomm msm8917_firmware All versions
cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*
qualcomm sdm845_firmware All versions
cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
qualcomm sdm660_firmware All versions
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
Original advisory text
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when access...
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when accessing the replay protected memory block.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published18 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-10050 · NVD
Track software like this
Free during beta