CVE-2019-14008

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-21 · updated 2026-06-17
Weakness: CWE-476

Description

Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9607, MDM9650, SDM660, SDM845, SM8150, SM8250, SXR2130

Affected products

Qualcomm Mdm9150 Firmware: all versions
Qualcomm Mdm9607 Firmware: all versions
Qualcomm Mdm9650 Firmware: all versions
Qualcomm Sdm660 Firmware: all versions
Qualcomm Sdm845 Firmware: all versions
Qualcomm Sm8150 Firmware: all versions
Qualcomm Sm8250 Firmware: all versions
Qualcomm Sxr2130 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin

Get alerted when CVE-2019-14008 or the next vulnerability affects your stack