CVE-2018-5882 Memory corruption in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

Critical 9.8 Published 6 Jul 2018 Updated 16 Sep 2024

A buffer over-read in Qualcomm Snapdragon firmware allows attackers to cause denial of service or potentially execute code via malicious FLAC files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-5882?

CVE-2018-5882 is a critical memory corruption vulnerability in Qualcomm Mdm9206 Firmware, published on 6 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

While parsing a Flac file with a corrupted comment block, a buffer over-read can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.

Weakness: CWE-125

Which versions are affected by CVE-2018-5882?

It affects 24 products.

Products include Qualcomm Mdm9206 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Msm8909w Firmware, Qualcomm Msm8996au Firmware, Qualcomm Sd 205 Firmware and 18 more.

How do I fix CVE-2018-5882?

No fix has been published for CVE-2018-5882 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-5882 being exploited?

There is no known exploitation of CVE-2018-5882 in the wild and no public exploit code.

All Qualcomm Mdm9206 Firmware vulnerabilities

Sources

Also known as GHSA-rx2x-7mpr-c4c4.