{"id":"CVE-2019-10542","aliases":["EUVD-2019-2346","GHSA-5hmw-95mp-p6wq"],"status":"published","title":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in...","description":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00711,"percentile":0.53842,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2019-11-06T17:11:23Z","modified":"2026-06-17T02:11:10Z","products":[{"vendor":"qualcomm","product":"mdm9150_firmware"},{"vendor":"qualcomm","product":"mdm9206_firmware"},{"vendor":"qualcomm","product":"mdm9607_firmware"},{"vendor":"qualcomm","product":"mdm9615_firmware"},{"vendor":"qualcomm","product":"mdm9640_firmware"},{"vendor":"qualcomm","product":"mdm9650_firmware"},{"vendor":"qualcomm","product":"msm8996au_firmware"},{"vendor":"qualcomm","product":"qca6174a_firmware"},{"vendor":"qualcomm","product":"qca6574au_firmware"},{"vendor":"qualcomm","product":"qca9377_firmware"},{"vendor":"qualcomm","product":"qca9379_firmware"},{"vendor":"qualcomm","product":"sd_205_firmware"},{"vendor":"qualcomm","product":"sd_210_firmware"},{"vendor":"qualcomm","product":"sd_212_firmware"},{"vendor":"qualcomm","product":"sd_425_firmware"},{"vendor":"qualcomm","product":"sd_427_firmware"},{"vendor":"qualcomm","product":"sd_430_firmware"},{"vendor":"qualcomm","product":"sd_435_firmware"},{"vendor":"qualcomm","product":"sd_450_firmware"},{"vendor":"qualcomm","product":"sd_600_firmware"},{"vendor":"qualcomm","product":"sd_625_firmware"},{"vendor":"qualcomm","product":"sd_670_firmware"},{"vendor":"qualcomm","product":"sd_710_firmware"},{"vendor":"qualcomm","product":"sd_712_firmware"},{"vendor":"qualcomm","product":"sd_820_firmware"},{"vendor":"qualcomm","product":"sd_820a_firmware"},{"vendor":"qualcomm","product":"sd_845_firmware"},{"vendor":"qualcomm","product":"sd_850_firmware"},{"vendor":"qualcomm","product":"sdx20_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice \u0026 music"}],"references":[{"url":"https://source.android.com/security/bulletin/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10542"},{"url":"https://github.com/advisories/GHSA-5hmw-95mp-p6wq"}],"sources":{"cve":[{"id":"CVE-2019-10542","description":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20","status":"published","published":"2019-11-06T17:11:23Z","modified":"2024-08-04T22:24:18.835Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-2346","description":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20","status":"published","published":"2019-11-06T17:11:23Z","modified":"2024-08-04T22:24:18Z","updated_at":"2026-11-03T02:40:52.16584Z"}],"ghsa":[{"id":"GHSA-5hmw-95mp-p6wq","title":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in...","description":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20","status":"published","published":"2022-05-24T17:00:32Z","modified":"2023-01-28T05:08:09Z","updated_at":"2026-11-02T14:44:36.474417Z"}],"nvd":[{"id":"CVE-2019-10542","description":"Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20","status":"published","published":"2019-11-06T17:15:12.91Z","modified":"2026-06-17T02:11:10.693Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:35.052973Z"}]}}