CVE-2018-11865 Integer overflow in Snapdragon Mobile, Snapdragon Wear

High 7.8 Published 29 Oct 2018 Updated 5 Aug 2024

An integer overflow in Qualcomm Snapdragon firmware allows attackers to potentially execute arbitrary code or escalate privileges via malformed input.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-11865?

CVE-2018-11865 is a high-severity vulnerability in Qualcomm Mdm9206 Firmware, published on 29 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Integer overflow may happen when calculating an internal structure size due to lack of validation of the input length in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.

Weakness: CWE-190

Which versions are affected by CVE-2018-11865?

It affects 24 products.

Products include Qualcomm Mdm9206 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 210 Firmware, Qualcomm Sd 212 Firmware and 18 more.

How do I fix CVE-2018-11865?

No fix has been published for CVE-2018-11865 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-11865 being exploited?

There is no known exploitation of CVE-2018-11865 in the wild and no public exploit code.

All Qualcomm Mdm9206 Firmware vulnerabilities

Sources

Also known as GHSA-xr69-67v4-f3fm.