CVE-2020-11261

Qualcomm Multiple Chipsets Improper Input Validation

7.8 HIGHActively exploited (CISA KEV)EPSS 1.60%

Published9 Jun 2021
Added to CISA KEV1 Dec 2021
Remediation due1 Jun 2022

Description

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Qualcomm Apq8009 Firmwareall versions

Qualcomm Apq8009w Firmwareall versions

Qualcomm Apq8017 Firmwareall versions

Qualcomm Apq8037 Firmwareall versions

Qualcomm Apq8053 Firmwareall versions

Qualcomm Apq8064au Firmwareall versions

Qualcomm Apq8096au Firmwareall versions

Qualcomm Aqt1000 Firmwareall versions

Qualcomm Ar8031 Firmwareall versions

Qualcomm Ar8035 Firmwareall versions

Qualcomm Ar8151 Firmwareall versions

Qualcomm Csra6620 Firmwareall versions

Qualcomm Csra6640 Firmwareall versions

Qualcomm Csrb31024 Firmwareall versions

Qualcomm Fsm10055 Firmwareall versions

Qualcomm Fsm10056 Firmwareall versions

Qualcomm Mdm9650 Firmwareall versions

Qualcomm Msm8909w Firmwareall versions

Qualcomm Msm8917 Firmwareall versions

Qualcomm Msm8920 Firmwareall versions

Qualcomm Msm8937 Firmwareall versions

Qualcomm Msm8940 Firmwareall versions

Qualcomm Msm8953 Firmwareall versions

Qualcomm Msm8996au Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11261US Government Resource
https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletinPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2020-11261 being actively exploited?

Yes. CVE-2020-11261 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 1 Dec 2021.

How severe is CVE-2020-11261?

CVE-2020-11261 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 1.60% probability of exploitation.

Which products are affected by CVE-2020-11261?

Affected products include Qualcomm Apq8009 Firmware, Qualcomm Apq8009w Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8037 Firmware, Qualcomm Apq8053 Firmware, and 19 more.

How do I fix CVE-2020-11261?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-11261 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.