CVE-2019-14082 Memory corruption in Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Critical 9.1 Published 5 Mar 2020 Updated 5 Aug 2024

A buffer over-read in Qualcomm WLAN firmware allows attackers to cause denial of service or disclose sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-14082?

CVE-2019-14082 is a critical memory corruption vulnerability in Qualcomm Ipq8074 Firmware, published on 5 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9207C, MDM9607, QCN7605, SM8150

Weakness: CWE-20, CWE-125

Which versions are affected by CVE-2019-14082?

It affects 6 products.

Products include Qualcomm Ipq8074 Firmware, Qualcomm Mdm9206 Firmware, Qualcomm Mdm9207c Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Qcn7605 Firmware, Qualcomm Sm8150 Firmware.

How do I fix CVE-2019-14082?

No fix has been published for CVE-2019-14082 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-14082 being exploited?

There is no known exploitation of CVE-2019-14082 in the wild and no public exploit code.

All Qualcomm Ipq8074 Firmware vulnerabilities

Sources

Also known as GHSA-9mr9-86gh-mpx9.