Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Qualcomm firmware may allow data overflow in fingerprint code

CVE-2018-11264 · published 7 years ago
Summary

Certain Qualcomm firmware used in automotive, mobile and wearable devices contains a flaw where the fingerprint code does not check the size of incoming data. This could let an attacker cause the software to crash or potentially take control of the device. Update to the latest firmware from Qualcomm as soon as it is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9607_firmware All versions
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9650_firmware All versions
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
qualcomm msm8996au_firmware All versions
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
qualcomm sd_210_firmware All versions
cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcomm sd_212_firmware All versions
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcomm sd_205_firmware All versions
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
qualcomm sd_410_firmware All versions
cpe:2.3:o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*
qualcomm sd_412_firmware All versions
cpe:2.3:o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*
qualcomm sd_425_firmware All versions
cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcomm sd_430_firmware All versions
cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcomm sd_450_firmware All versions
cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
qualcomm sd_625_firmware All versions
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
qualcomm sd_650_firmware All versions
cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*
qualcomm sd_652_firmware All versions
cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820_firmware All versions
cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820a_firmware All versions
cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:*
qualcomm sd_835_firmware All versions
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
qualcomm sda660_firmware All versions
cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*
Original advisory text
Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in v...
Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published28 Nov 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-11264 · NVD
Track software like this
Free during beta