← Vulnerability feed

Vulnerability record · CVE-2020-3678 · published 2 November 2020

CVE-2020-3678: Qualcomm agatti firmware classic buffer overflow vulnerability

Qualcomm · Agatti Firmware

u'A buffer overflow could occur if the API is improperly used due to UIE init does not contain a buffer size a param' in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130

7.8 CVSS 3.1 High EPSS 0.23% · top 87.6% CWE-120 · Classic buffer overflow
7.8CVSS 3.1 base score, v2 4.6
0.23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
9Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

u'A buffer overflow could occur if the API is improperly used due to UIE init does not contain a buffer size a param' in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin Broken Link
https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin Broken Link

Track CVE-2020-3678 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-33063Qualcomm DSP Services use-after-free memory corruptionCVE-2023-33063 is a use-after-free memory corruption flaw in Qualcomm DSP Services, triggered during a remote call from the high-level operating syst…KEVEPSS 0.67%analysed7.8CVE-2021-1905Qualcomm Snapdragon chipsets use-after-free in memory mapping handlingA use-after-free flaw exists in multiple Qualcomm Snapdragon chipset families due to improper handling of memory mapping when multiple processes oper…KEVEPSS 1.5%analysed5.5CVE-2021-1906Qualcomm Snapdragon GPU address deregistration failure causes allocation denialImproper handling of address deregistration on failure in Qualcomm Snapdragon chipsets can cause subsequent GPU address allocation to fail. The flaw …KEVEPSS 0.52%analysed9.8CVE-2023-28543Qualcomm sd855 firmware out-of-bounds read vulnerabilityA malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote so…EPSS 0.36%9.8CVE-2022-40510Qualcomm apq8009 firmware out-of-bounds write vulnerabilityMemory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.EPSS 0.43%9.8CVE-2022-40515Qualcomm apq8009 firmware double free vulnerabilityMemory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.EPSS 0.33%9.8CVE-2022-40537Qualcomm apq8009 firmware vulnerabilityMemory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.EPSS 0.36%9.8CVE-2022-40514Qualcomm aqt1000 firmware classic buffer overflow vulnerabilityMemory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2020-3678), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.