CVE-2020-11220

While processing storage SCM commands there is a time of check or time of use window where a...

6.4 Medium

While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing the storage SCM call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.14%Down 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 6.4

Record: CVE-2020-11220
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-367
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-11220
Updated: 2026-11-02

EUVDEUVD-2020-3574 No score

Record: EUVD-2020-3574
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p7xv-94hw-xx6p No score

While processing storage SCM commands there is a time of check or time of use window where a...

Record: GHSA-p7xv-94hw-xx6p
Weakness: CWE-367
Updated: 2026-11-02

Affected products

Show 120 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11220 is a medium vulnerability (CVSS 6.4) in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Wired Infrastructure And Networking, published March 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. No source names a fixed version.