{"id":"CVE-2020-11254","aliases":["2740910","A-172354397","EUVD-2020-3608","GHSA-938v-qrv3-mj9q","PUB-A-172354397"],"status":"published","title":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without...","description":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00134,"percentile":0.02912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-05-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["SoCVersion:2021-05-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2021-05-05"}]}],"versions":["SoCVersion"]}],"products":[{"vendor":"qualcomm","product":"pm6150a"},{"vendor":"qualcomm","product":"pm6150l"},{"vendor":"qualcomm","product":"pm6350"},{"vendor":"qualcomm","product":"pm660"},{"vendor":"qualcomm","product":"pm660l"},{"vendor":"qualcomm","product":"pm7250b"},{"vendor":"qualcomm","product":"pm8008"},{"vendor":"qualcomm","product":"pm8009"},{"vendor":"qualcomm","product":"pm8350"},{"vendor":"qualcomm","product":"pm8350b"},{"vendor":"qualcomm","product":"pm8350bh"},{"vendor":"qualcomm","product":"pm8350c"},{"vendor":"qualcomm","product":"pmk8003"},{"vendor":"qualcomm","product":"pmk8350"},{"vendor":"qualcomm","product":"pmm6155au"},{"vendor":"qualcomm","product":"pmm8155au"},{"vendor":"qualcomm","product":"pmm8195au"},{"vendor":"qualcomm","product":"pmr735a"},{"vendor":"qualcomm","product":"pmr735b"},{"vendor":"qualcomm","product":"qat3516"},{"vendor":"qualcomm","product":"qat3518"},{"vendor":"qualcomm","product":"qat3519"},{"vendor":"qualcomm","product":"qat3555"},{"vendor":"qualcomm","product":"qat5515"},{"vendor":"qualcomm","product":"qat5516"},{"vendor":"qualcomm","product":"qat5522"},{"vendor":"qualcomm","product":"qat5568"},{"vendor":"qualcomm","product":"qbt1500"},{"vendor":"qualcomm","product":"qca6574au"},{"vendor":"qualcomm","product":"qca6696"},{"vendor":"qualcomm","product":"qdm3301"},{"vendor":"qualcomm","product":"qdm4643"},{"vendor":"qualcomm","product":"qdm4650"},{"vendor":"qualcomm","product":"qdm5620"},{"vendor":"qualcomm","product":"qdm5621"},{"vendor":"qualcomm","product":"qdm5670"},{"vendor":"qualcomm","product":"qdm5671"},{"vendor":"qualcomm","product":"qet5100"},{"vendor":"qualcomm","product":"qet5100m"},{"vendor":"qualcomm","product":"qet6100"},{"vendor":"qualcomm","product":"qet6105"},{"vendor":"qualcomm","product":"qet6110"},{"vendor":"qualcomm","product":"qfs2530"},{"vendor":"qualcomm","product":"qfs2580"},{"vendor":"qualcomm","product":"qfs2608"},{"vendor":"qualcomm","product":"qfs2630"},{"vendor":"qualcomm","product":"qln4642"},{"vendor":"qualcomm","product":"qln4650"},{"vendor":"qualcomm","product":"qln5020"},{"vendor":"qualcomm","product":"qln5030"},{"vendor":"qualcomm","product":"qln5040"},{"vendor":"qualcomm","product":"qpa2625"},{"vendor":"qualcomm","product":"qpa5461"},{"vendor":"qualcomm","product":"qpa5580"},{"vendor":"qualcomm","product":"qpa5581"},{"vendor":"qualcomm","product":"qpa8801"},{"vendor":"qualcomm","product":"qpa8802"},{"vendor":"qualcomm","product":"qpa8803"},{"vendor":"qualcomm","product":"qpa8821"},{"vendor":"qualcomm","product":"qpa8842"},{"vendor":"qualcomm","product":"qpm4621"},{"vendor":"qualcomm","product":"qpm4630"},{"vendor":"qualcomm","product":"qpm4640"},{"vendor":"qualcomm","product":"qpm4641"},{"vendor":"qualcomm","product":"qpm4650"},{"vendor":"qualcomm","product":"qpm5621"},{"vendor":"qualcomm","product":"qpm5641"},{"vendor":"qualcomm","product":"qpm5670"},{"vendor":"qualcomm","product":"qpm5677"},{"vendor":"qualcomm","product":"qpm5679"},{"vendor":"qualcomm","product":"qpm5870"},{"vendor":"qualcomm","product":"qpm5875"},{"vendor":"qualcomm","product":"qpm6585"},{"vendor":"qualcomm","product":"qpm6621"},{"vendor":"qualcomm","product":"qpm6670"},{"vendor":"qualcomm","product":"qpm8820"},{"vendor":"qualcomm","product":"qpm8870"},{"vendor":"qualcomm","product":"qtc800h"},{"vendor":"qualcomm","product":"qtc800s"},{"vendor":"qualcomm","product":"qtc801s"},{"vendor":"qualcomm","product":"qtm525"},{"vendor":"qualcomm","product":"sa6145p"},{"vendor":"qualcomm","product":"sa6150p"},{"vendor":"qualcomm","product":"sa6155p"},{"vendor":"qualcomm","product":"sa8150p"},{"vendor":"qualcomm","product":"sa8155p"},{"vendor":"qualcomm","product":"sa8195p"},{"vendor":"qualcomm","product":"sd480"},{"vendor":"qualcomm","product":"sd670"},{"vendor":"qualcomm","product":"sd710"},{"vendor":"qualcomm","product":"sd888"},{"vendor":"qualcomm","product":"sd888_5g"},{"vendor":"qualcomm","product":"sdr660"},{"vendor":"qualcomm","product":"sdr660g"},{"vendor":"qualcomm","product":"sdr735"},{"vendor":"qualcomm","product":"sdr735g"},{"vendor":"qualcomm","product":"sdr865"},{"vendor":"qualcomm","product":"sdxr1"},{"vendor":"qualcomm","product":"smb1351"},{"vendor":"qualcomm","product":"smb1355"},{"vendor":"qualcomm","product":"smb1396"},{"vendor":"qualcomm","product":"smb1398"},{"vendor":"qualcomm","product":"smr526"},{"vendor":"qualcomm","product":"smr545"},{"vendor":"qualcomm","product":"smr546"},{"vendor":"qualcomm","product":"wcd9326"},{"vendor":"qualcomm","product":"wcd9341"},{"vendor":"qualcomm","product":"wcd9370"},{"vendor":"qualcomm","product":"wcd9375"},{"vendor":"qualcomm","product":"wcd9380"},{"vendor":"qualcomm","product":"wcd9385"},{"vendor":"qualcomm","product":"wcn3980"},{"vendor":"qualcomm","product":"wcn3988"},{"vendor":"qualcomm","product":"wcn3990"},{"vendor":"qualcomm","product":"wcn3991"},{"vendor":"qualcomm","product":"wcn6850"},{"vendor":"qualcomm","product":"wcn6851"},{"vendor":"qualcomm","product":"wcn6855"},{"vendor":"qualcomm","product":"wcn6856"},{"vendor":"qualcomm","product":"wsa8830"},{"vendor":"qualcomm","product":"wsa8835"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon mobile"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11254"},{"url":"https://github.com/advisories/GHSA-938v-qrv3-mj9q"},{"url":"https://source.android.com/security/bulletin/2021-05-01","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-11254","description":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile","status":"published","published":"2021-05-07T09:10:30Z","modified":"2024-08-04T11:28:13.799Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-3608","description":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile","status":"published","published":"2021-05-07T09:10:30Z","modified":"2024-08-04T11:28:13Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:07:47.032228Z"}],"ghsa":[{"id":"GHSA-938v-qrv3-mj9q","title":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without...","description":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile","status":"published","published":"2022-05-24T19:01:50Z","modified":"2023-01-29T05:07:34Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:10.663769Z"}],"nvd":[{"id":"CVE-2020-11254","description":"Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile","status":"published","published":"2021-05-07T09:15:07.73Z","modified":"2026-06-17T02:49:47.95Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:39.25999Z"}],"osv":[{"id":"PUB-A-172354397","status":"published","published":"2021-05-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-09T17:05:18.698671Z"}]}}