What’s Vulnerable › Vulnerabilities

CVE-2020-11197

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-21 · updated 2026-06-17
• Weakness: CWE-190

Description

Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with invalid data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Affected products

• Qualcomm Apq8009: all versions
• Qualcomm Apq8009W: all versions
• Qualcomm Apq8017: all versions
• Qualcomm Apq8037: all versions
• Qualcomm Apq8053: all versions
• Qualcomm Apq8064Au: all versions
• Qualcomm Apq8096Au: all versions
• Qualcomm Aqt1000: all versions
• Qualcomm Ar8031: all versions
• Qualcomm Ar8151: all versions
• Qualcomm Csra6620: all versions
• Qualcomm Csra6640: all versions
• Qualcomm Mdm9206: all versions
• Qualcomm Mdm9650: all versions
• Qualcomm Msm8909W: all versions
• Qualcomm Msm8917: all versions
• Qualcomm Msm8920: all versions
• Qualcomm Msm8937: all versions
• Qualcomm Msm8940: all versions
• Qualcomm Msm8953: all versions
• Qualcomm Msm8996Au: all versions
• Qualcomm Pm215: all versions
• Qualcomm Pm3003A: all versions
• Qualcomm Pm4125: all versions
• Qualcomm Pm439: all versions
• Qualcomm Pm456: all versions
• Qualcomm Pm6125: all versions
• Qualcomm Pm6150: all versions
• Qualcomm Pm6150A: all versions
• Qualcomm Pm6150L: all versions

References

• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin
• https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin

Get alerted when CVE-2020-11197 or the next vulnerability affects your stack