CVE-2020-11261: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Affects Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WearablesSource CISA KEV
No CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 12/01/2021
- KEV deadline
- 06/01/2022
- EPSS
- 1.6% chance of exploitation in 30 days – higher than 75% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2020-11261 is a high-severity vulnerability affecting multiple Qualcomm Snapdragon chipsets. It involves improper input validation that can lead to memory corruption when a user application requests an excessively large memory allocation. The affected Snapdragon platforms include Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.