CVE-2020-11170

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-22 · updated 2026-06-17
Weakness: CWE-120

Description

Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Affected products

Qualcomm Apq8009 Firmware: all versions
Qualcomm Apq8009W Firmware: all versions
Qualcomm Apq8017 Firmware: all versions
Qualcomm Apq8030 Firmware: all versions
Qualcomm Apq8037 Firmware: all versions
Qualcomm Apq8052 Firmware: all versions
Qualcomm Apq8053 Firmware: all versions
Qualcomm Apq8056 Firmware: all versions
Qualcomm Apq8060A Firmware: all versions
Qualcomm Apq8062 Firmware: all versions
Qualcomm Apq8064 Firmware: all versions
Qualcomm Apq8064Au Firmware: all versions
Qualcomm Apq8076 Firmware: all versions
Qualcomm Apq8084 Firmware: all versions
Qualcomm Apq8096Au Firmware: all versions
Qualcomm Aqt1000 Firmware: all versions
Qualcomm Ar6003 Firmware: all versions
Qualcomm Ar8031 Firmware: all versions
Qualcomm Ar8035 Firmware: all versions
Qualcomm Ar8151 Firmware: all versions
Qualcomm Ar9374 Firmware: all versions
Qualcomm Csra6620 Firmware: all versions
Qualcomm Csra6640 Firmware: all versions
Qualcomm Mdm8207 Firmware: all versions
Qualcomm Mdm8215 Firmware: all versions
Qualcomm Mdm8215M Firmware: all versions
Qualcomm Mdm8615M Firmware: all versions
Qualcomm Mdm8635M Firmware: all versions
Qualcomm Mdm9205 Firmware: all versions
Qualcomm Mdm9206 Firmware: all versions

References

Get alerted when CVE-2020-11170 or the next vulnerability affects your stack