CVE-2019-14086 Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Critical 9.8 Published 5 Mar 2020 Updated 5 Aug 2024

An integer overflow in Qualcomm Snapdragon firmware allows attackers to cause unexpected results, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-14086?

CVE-2019-14086 is a critical vulnerability in Qualcomm Apq8098 Firmware, published on 5 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead to unexpected result during the check in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8098, MDM9607, MSM8998, QCA6584, QCN7605, QCS605, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130

Weakness: CWE-190

Which versions are affected by CVE-2019-14086?

It affects 18 products.

Products include Qualcomm Apq8098 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Msm8998 Firmware, Qualcomm Qca6584 Firmware, Qualcomm Qcn7605 Firmware, Qualcomm Qcs605 Firmware and 12 more.

How do I fix CVE-2019-14086?

No fix has been published for CVE-2019-14086 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-14086 being exploited?

There is no known exploitation of CVE-2019-14086 in the wild and no public exploit code.

All Qualcomm Apq8098 Firmware vulnerabilities

Sources

Also known as GHSA-pw88-vjvh-qg94.