Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Qualcomm firmware may miscalculate size and crash

CVE-2018-11865 · published 8 years ago
Summary

The firmware for Qualcomm MDM9206, MDM9607, MDM9650, SD210 and SD212 devices can miscalculate how much memory to allocate when given unusually long input. This miscalculation can cause the system to behave unpredictably or stop working. Apply the latest firmware updates from Qualcomm as soon as they are available to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9607_firmware All versions
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9650_firmware All versions
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
qualcomm sd_210_firmware All versions
cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcomm sd_212_firmware All versions
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcomm sd_205_firmware All versions
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
qualcomm sd_425_firmware All versions
cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcomm sd_427_firmware All versions
cpe:2.3:o:qualcomm:sd_427_firmware:-:*:*:*:*:*:*:*
qualcomm sd_430_firmware All versions
cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcomm sd_435_firmware All versions
cpe:2.3:o:qualcomm:sd_435_firmware:-:*:*:*:*:*:*:*
qualcomm sd_450_firmware All versions
cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
qualcomm sd_625_firmware All versions
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
qualcomm sd_835_firmware All versions
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
qualcomm sd_845_firmware All versions
cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
qualcomm sd_850_firmware All versions
cpe:2.3:o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
qualcomm sda660_firmware All versions
cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*
qualcomm sdm429_firmware All versions
cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:*
qualcomm sdm439_firmware All versions
cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:*
qualcomm sdm630_firmware All versions
cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
qualcomm sdm632_firmware All versions
cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:*
qualcomm sdm636_firmware All versions
cpe:2.3:o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:*
qualcomm sdm660_firmware All versions
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
qualcomm sdm710_firmware All versions
cpe:2.3:o:qualcomm:sdm710_firmware:-:*:*:*:*:*:*:*
qualcomm snapdragon_high_med_2016_firmware All versions
cpe:2.3:o:qualcomm:snapdragon_high_med_2016_firmware:-:*:*:*:*:*:*:*
Original advisory text
Integer overflow may happen when calculating an internal structure size due to lack of validation of the input length in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD ...
Integer overflow may happen when calculating an internal structure size due to lack of validation of the input length in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published29 Oct 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-11865 · NVD
Track software like this
Free during beta