CVE-2020-11156

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-02 · updated 2026-06-17
Weakness: CWE-20

Description

u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in QCA6390, QCN7605, QCS404, SA415M, SA515M, SC8180X, SDX55, SM8250

Affected products

Qualcomm Qca6390 Firmware: all versions
Qualcomm Qcn7605 Firmware: all versions
Qualcomm Qcs404 Firmware: all versions
Qualcomm Sa415M Firmware: all versions
Qualcomm Sa515M Firmware: all versions
Qualcomm Sc8180X Firmware: all versions
Qualcomm Sdx55 Firmware: all versions
Qualcomm Sm8250 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin

Get alerted when CVE-2020-11156 or the next vulnerability affects your stack