What’s Vulnerable › Vulnerabilities

CVE-2020-11167

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-21 · updated 2026-06-17
• Weakness: CWE-190

Description

Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Affected products

• Qualcomm Apq8009W: all versions
• Qualcomm Apq8017: all versions
• Qualcomm Apq8037: all versions
• Qualcomm Apq8053: all versions
• Qualcomm Apq8064Au: all versions
• Qualcomm Apq8096Au: all versions
• Qualcomm Aqt1000: all versions
• Qualcomm Msm8909W: all versions
• Qualcomm Msm8917: all versions
• Qualcomm Msm8920: all versions
• Qualcomm Msm8937: all versions
• Qualcomm Msm8940: all versions
• Qualcomm Msm8953: all versions
• Qualcomm Msm8996Au: all versions
• Qualcomm Pm215: all versions
• Qualcomm Pm3003A: all versions
• Qualcomm Pm439: all versions
• Qualcomm Pm6125: all versions
• Qualcomm Pm6150: all versions
• Qualcomm Pm6150A: all versions
• Qualcomm Pm6150L: all versions
• Qualcomm Pm6350: all versions
• Qualcomm Pm640A: all versions
• Qualcomm Pm640L: all versions
• Qualcomm Pm640P: all versions
• Qualcomm Pm660: all versions
• Qualcomm Pm660L: all versions
• Qualcomm Pm670: all versions
• Qualcomm Pm670A: all versions
• Qualcomm Pm670L: all versions

References

• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Get alerted when CVE-2020-11167 or the next vulnerability affects your stack