CVE-2021-1905

Qualcomm Multiple Chipsets Use-After-Free

8.4 HIGHActively exploited (CISA KEV)EPSS 1.54%

Published7 May 2021
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Qualcomm Apq8009 Firmwareall versions

Qualcomm Apq8009w Firmwareall versions

Qualcomm Apq8017 Firmwareall versions

Qualcomm Apq8053 Firmwareall versions

Qualcomm Apq8064au Firmwareall versions

Qualcomm Apq8096au Firmwareall versions

Qualcomm Aqt1000 Firmwareall versions

Qualcomm Ar8031 Firmwareall versions

Qualcomm Ar8035 Firmwareall versions

Qualcomm Ar8151 Firmwareall versions

Qualcomm Csra6620 Firmwareall versions

Qualcomm Csra6640 Firmwareall versions

Qualcomm Fsm10055 Firmwareall versions

Qualcomm Fsm10056 Firmwareall versions

Qualcomm Mdm9206 Firmwareall versions

Qualcomm Mdm9607 Firmwareall versions

Qualcomm Mdm9626 Firmwareall versions

Qualcomm Mdm9628 Firmwareall versions

Qualcomm Mdm9650 Firmwareall versions

Qualcomm Msm8909w Firmwareall versions

Qualcomm Msm8917 Firmwareall versions

Qualcomm Msm8953 Firmwareall versions

Qualcomm Msm8996au Firmwareall versions

Qualcomm Pm215 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1905US Government Resource
https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletinPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-1905 being actively exploited?

Yes. CVE-2021-1905 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2021-1905?

CVE-2021-1905 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 1.54% probability of exploitation.

Which products are affected by CVE-2021-1905?

Affected products include Qualcomm Apq8009 Firmware, Qualcomm Apq8009w Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8053 Firmware, Qualcomm Apq8064au Firmware, and 19 more.

How do I fix CVE-2021-1905?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-1905 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.