CVE-2018-11858

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-29 · updated 2026-06-17
Weakness: CWE-119

Description

When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version SD 835, SD 845, SD 850.

Affected products

Qualcomm Sd 835 Firmware: all versions
Qualcomm Sd 845 Firmware: all versions
Qualcomm Sd 850 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins
https://www.qualcomm.com/company/product-security/bulletins

Get alerted when CVE-2018-11858 or the next vulnerability affects your stack