CVE-2019-14009

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-16 · updated 2026-06-17
Weakness: CWE-119

Description

Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, MDM9150, MDM9607, MDM9650, MSM8905, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845, SDM850, SXR2130

Affected products

Qualcomm Apq8009 Firmware: all versions
Qualcomm Apq8098 Firmware: all versions
Qualcomm Mdm9150 Firmware: all versions
Qualcomm Mdm9607 Firmware: all versions
Qualcomm Mdm9650 Firmware: all versions
Qualcomm Msm8905 Firmware: all versions
Qualcomm Msm8909 Firmware: all versions
Qualcomm Msm8998 Firmware: all versions
Qualcomm Sda660 Firmware: all versions
Qualcomm Sda845 Firmware: all versions
Qualcomm Sdm630 Firmware: all versions
Qualcomm Sdm636 Firmware: all versions
Qualcomm Sdm660 Firmware: all versions
Qualcomm Sdm845 Firmware: all versions
Qualcomm Sdm850 Firmware: all versions
Qualcomm Sxr2130 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin

Get alerted when CVE-2019-14009 or the next vulnerability affects your stack