Vulnerability record · CVE-2020-11144 · published 21 January 2021

CVE-2020-11144: Qualcomm apq8009 improper input validation vulnerability

Qualcomm · Apq8009

Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

9.1 CVSS 3.1 Critical EPSS 0.88% · top 42.3% CWE-20 · Improper input validationCWE-125 · Out-of-bounds read

9.1CVSS 3.1 base score, v2 6.4

0.88%EPSS exploitation probability, 30 days

NoNot in CISA KEV

150Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Apq8009 Qualcomm

Apq8009w Qualcomm

Apq8017 Qualcomm

Apq8037 Qualcomm

Apq8053 Qualcomm

Apq8084 Qualcomm

Apq8096au Qualcomm

Aqt1000 Qualcomm

Ar6003 Qualcomm

Ar8035 Qualcomm

Ar8151 Qualcomm

Csr6030 Qualcomm

Csrb31024 Qualcomm

Fsm10055 Qualcomm

Mdm8207 Qualcomm

Mdm8215 Qualcomm

Mdm8215m Qualcomm

Mdm8615m Qualcomm

Mdm9150 Qualcomm

Mdm9205 Qualcomm

Mdm9206 Qualcomm

Mdm9207 Qualcomm

Mdm9215 Qualcomm

Mdm9230 Qualcomm

Mdm9250 Qualcomm

Mdm9310 Qualcomm

Mdm9330 Qualcomm

Mdm9607 Qualcomm

Mdm9615 Qualcomm

Mdm9615m Qualcomm

Mdm9625 Qualcomm

Mdm9628 Qualcomm

Mdm9630 Qualcomm

Mdm9635m Qualcomm

Mdm9640 Qualcomm

Mdm9645 Qualcomm

Mdm9650 Qualcomm

Mdm9655 Qualcomm

Msm8108 Qualcomm

Msm8208 Qualcomm

Msm8209 Qualcomm

Msm8608 Qualcomm

Msm8909w Qualcomm

Msm8917 Qualcomm

Msm8920 Qualcomm

Msm8937 Qualcomm

Msm8940 Qualcomm

Msm8953 Qualcomm

Msm8976 Qualcomm

Msm8976sg Qualcomm

Msm8996au Qualcomm

Pm215 Qualcomm

Pm3003a Qualcomm

Pm4125 Qualcomm

Pm439 Qualcomm

Pm456 Qualcomm

Pm6125 Qualcomm

Pm6150 Qualcomm

Pm6150a Qualcomm

Pm6150l Qualcomm

Pm6250 Qualcomm

Pm640a Qualcomm

Pm640l Qualcomm

Pm640p Qualcomm

Pm660 Qualcomm

Pm660a Qualcomm

Pm660l Qualcomm

Pm670 Qualcomm

Pm670l Qualcomm

Pm7150a Qualcomm

Pm7150l Qualcomm

Pm7250 Qualcomm

Pm7250b Qualcomm

Pm8004 Qualcomm

Pm8005 Qualcomm

Pm8008 Qualcomm

Pm8009 Qualcomm

Pm8018 Qualcomm

Pm8019 Qualcomm

Pm8150 Qualcomm

References

Link	Tags
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin	Broken Link
https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin	Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin	Broken Link

Track CVE-2020-11144 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-11283Qualcomm apq8009 out-of-bounds write vulnerabilityA buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…EPSS 0.71%22 Feb 2021 9.8CVE-2020-3686Qualcomm apq8009 classic buffer overflow vulnerabilityPossible memory out of bound issue during music playback when an incorrect bit stream content is copied into array without checking the length of arr…EPSS 1.2%21 Jan 2021 9.8CVE-2020-3691Qualcomm apq8009 vulnerabilityPossible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snap…EPSS 1.1%21 Jan 2021 9.8CVE-2020-11213Qualcomm apq8009 out-of-bounds read vulnerabilityOut of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon C…EPSS 0.87%21 Jan 2021 9.8CVE-2020-11197Qualcomm apq8009 integer overflow vulnerabilityPossible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with inval…EPSS 0.91%21 Jan 2021 9.8CVE-2020-11216Qualcomm apq8009 out-of-bounds read vulnerabilityBuffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdrago…EPSS 0.91%21 Jan 2021 9.8CVE-2020-11167Qualcomm apq8009w integer overflow vulnerabilityMemory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, Snapdragon …EPSS 1.2%21 Jan 2021 9.8CVE-2020-11212Qualcomm apq8009 out-of-bounds read vulnerabilityOut of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon Compute, Snapd…EPSS 0.87%21 Jan 2021

Source: NIST National Vulnerability Database (record CVE-2020-11144), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.