CVE-2019-2281 Code injection in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

High 7.8 Published 25 Jul 2019 Updated 4 Aug 2024

An attacker can execute arbitrary code by loading a malicious bitmap image into memory on affected Qualcomm Snapdragon devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-2281?

CVE-2019-2281 is a high-severity code injection vulnerability in Qualcomm Qcs405 Firmware, published on 25 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX24, SXR1130

Which versions are affected by CVE-2019-2281?

It affects 20 products.

Products include Qualcomm Qcs405 Firmware, Qualcomm Qcs605 Firmware, Qualcomm Sd 636 Firmware, Qualcomm Sd 665 Firmware, Qualcomm Sd 670 Firmware, Qualcomm Sd 675 Firmware and 14 more.

How do I fix CVE-2019-2281?

No fix has been published for CVE-2019-2281 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-2281 being exploited?

There is no known exploitation of CVE-2019-2281 in the wild and no public exploit code.

All Qualcomm Qcs405 Firmware vulnerabilities

Sources

Also known as GHSA-rp2g-3r74-42mj.