{"id":"CVE-2019-2256","aliases":["EUVD-2019-11898","GHSA-mfrv-fwwq-96p5"],"status":"published","title":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains...","description":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01529,"percentile":0.74918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-06-14T17:02:10Z","modified":"2026-06-17T02:33:32Z","products":[{"vendor":"qualcomm","product":"mdm9650_firmware"},{"vendor":"qualcomm","product":"msm8909w_firmware"},{"vendor":"qualcomm","product":"msm8996au_firmware"},{"vendor":"qualcomm","product":"qcs605_firmware"},{"vendor":"qualcomm","product":"qm215_firmware"},{"vendor":"qualcomm","product":"sd_205_firmware"},{"vendor":"qualcomm","product":"sd_210_firmware"},{"vendor":"qualcomm","product":"sd_212_firmware"},{"vendor":"qualcomm","product":"sd_425_firmware"},{"vendor":"qualcomm","product":"sd_427_firmware"},{"vendor":"qualcomm","product":"sd_429_firmware"},{"vendor":"qualcomm","product":"sd_430_firmware"},{"vendor":"qualcomm","product":"sd_435_firmware"},{"vendor":"qualcomm","product":"sd_439_firmware"},{"vendor":"qualcomm","product":"sd_450_firmware"},{"vendor":"qualcomm","product":"sd_625_firmware"},{"vendor":"qualcomm","product":"sd_632_firmware"},{"vendor":"qualcomm","product":"sd_636_firmware"},{"vendor":"qualcomm","product":"sd_670_firmware"},{"vendor":"qualcomm","product":"sd_675_firmware"},{"vendor":"qualcomm","product":"sd_710_firmware"},{"vendor":"qualcomm","product":"sd_712_firmware"},{"vendor":"qualcomm","product":"sd_820_firmware"},{"vendor":"qualcomm","product":"sd_820a_firmware"},{"vendor":"qualcomm","product":"sd_835_firmware"},{"vendor":"qualcomm","product":"sd_845_firmware"},{"vendor":"qualcomm","product":"sd_850_firmware"},{"vendor":"qualcomm","product":"sd_855_firmware"},{"vendor":"qualcomm","product":"sd_8cx_firmware"},{"vendor":"qualcomm","product":"sda660_firmware"},{"vendor":"qualcomm","product":"sdm439_firmware"},{"vendor":"qualcomm","product":"sdm630_firmware"},{"vendor":"qualcomm","product":"sdm660_firmware"},{"vendor":"qualcomm","product":"snapdragon_high_med_2016_firmware"},{"vendor":"qualcomm","product":"sxr1130_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice \u0026 music, snapdragon wearables"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2256"},{"url":"https://github.com/advisories/GHSA-mfrv-fwwq-96p5"}],"sources":{"cve":[{"id":"CVE-2019-2256","description":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130","status":"published","published":"2019-06-14T17:02:10Z","modified":"2024-08-04T18:42:50.895Z","updated_at":"2026-11-02T14:20:22.3662Z"}],"euvd":[{"id":"EUVD-2019-11898","description":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130","status":"published","published":"2019-06-14T17:02:10Z","modified":"2024-08-04T18:42:50Z","updated_at":"2026-11-03T03:06:56.04689Z"}],"ghsa":[{"id":"GHSA-mfrv-fwwq-96p5","title":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains...","description":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130","status":"published","published":"2022-05-24T16:48:05Z","modified":"2023-01-28T05:05:38Z","updated_at":"2026-11-02T14:44:21.953506Z"}],"nvd":[{"id":"CVE-2019-2256","description":"An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130","status":"published","published":"2019-06-14T17:29:02.69Z","modified":"2026-06-17T02:33:32.477Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:16.285679Z"}]}}