CVE-2019-10510

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-30 · updated 2026-06-17
Weakness: CWE-476

Description

BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660

Affected products

Qualcomm Qcs405 Firmware: all versions
Qualcomm Qcs605 Firmware: all versions
Qualcomm Sd 636 Firmware: all versions
Qualcomm Sd 675 Firmware: all versions
Qualcomm Sd 730 Firmware: all versions
Qualcomm Sd 820A Firmware: all versions
Qualcomm Sd 835 Firmware: all versions
Qualcomm Sd 845 Firmware: all versions
Qualcomm Sd 850 Firmware: all versions
Qualcomm Sd 855 Firmware: all versions
Qualcomm Sdm630 Firmware: all versions
Qualcomm Sdm660 Firmware: all versions

References

https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin

Get alerted when CVE-2019-10510 or the next vulnerability affects your stack