CVE-2015-9220

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-18 · updated 2026-06-17
Weakness: CWE-190

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.

Affected products

Qualcomm Ipq4019 Firmware: all versions
Qualcomm Ipq8064 Firmware: all versions
Qualcomm Mdm9206 Firmware: all versions
Qualcomm Mdm9607 Firmware: all versions
Qualcomm Mdm9640 Firmware: all versions
Qualcomm Mdm9650 Firmware: all versions
Qualcomm Qca4531 Firmware: all versions
Qualcomm Qca6174A Firmware: all versions
Qualcomm Qca6574Au Firmware: all versions
Qualcomm Qca6584 Firmware: all versions
Qualcomm Qca6584Au Firmware: all versions
Qualcomm Qca9377 Firmware: all versions
Qualcomm Qca9378 Firmware: all versions
Qualcomm Qca9379 Firmware: all versions
Qualcomm Qca9558 Firmware: all versions
Qualcomm Qca9880 Firmware: all versions
Qualcomm Qca9886 Firmware: all versions
Qualcomm Qca9980 Firmware: all versions
Qualcomm Sd 205 Firmware: all versions
Qualcomm Sd 210 Firmware: all versions
Qualcomm Sd 212 Firmware: all versions
Qualcomm Sd 425 Firmware: all versions
Qualcomm Sd 625 Firmware: all versions
Qualcomm Sd 810 Firmware: all versions
Qualcomm Sd 820 Firmware: all versions
Qualcomm Sdx20 Firmware: all versions

References

Get alerted when CVE-2015-9220 or the next vulnerability affects your stack