What’s Vulnerable › Vulnerabilities

CVE-2020-11148

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-21 · updated 2026-06-17
• Weakness: CWE-416

Description

Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Affected products

• Qualcomm Apq8017: all versions
• Qualcomm Apq8053: all versions
• Qualcomm Msm8917: all versions
• Qualcomm Msm8953: all versions
• Qualcomm Pm215: all versions
• Qualcomm Pm3003A: all versions
• Qualcomm Pm439: all versions
• Qualcomm Pm6125: all versions
• Qualcomm Pm6150: all versions
• Qualcomm Pm6150A: all versions
• Qualcomm Pm6150L: all versions
• Qualcomm Pm6350: all versions
• Qualcomm Pm640A: all versions
• Qualcomm Pm640L: all versions
• Qualcomm Pm640P: all versions
• Qualcomm Pm660: all versions
• Qualcomm Pm660L: all versions
• Qualcomm Pm670: all versions
• Qualcomm Pm670L: all versions
• Qualcomm Pm7150A: all versions
• Qualcomm Pm7150L: all versions
• Qualcomm Pm7250: all versions
• Qualcomm Pm7250B: all versions
• Qualcomm Pm7350C: all versions
• Qualcomm Pm8008: all versions
• Qualcomm Pm8009: all versions
• Qualcomm Pm8150A: all versions
• Qualcomm Pm8150B: all versions
• Qualcomm Pm8150C: all versions
• Qualcomm Pm8150L: all versions

References

• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Get alerted when CVE-2020-11148 or the next vulnerability affects your stack