CVE-2020-11153

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-02 · updated 2026-06-17
Weakness: CWE-787

Description

u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8053, QCA6390, QCA9379, QCN7605, SC8180X, SDX55

Affected products

Qualcomm Apq8053 Firmware: all versions
Qualcomm Qca6390 Firmware: all versions
Qualcomm Qca9379 Firmware: all versions
Qualcomm Qcn7605 Firmware: all versions
Qualcomm Sc8180X Firmware: all versions
Qualcomm Sdx55 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin

Get alerted when CVE-2020-11153 or the next vulnerability affects your stack