CVE-2020-11261
Published 2021-06-09 · Updated 2026-06-17 · Source product-security@qualcomm.com
Summary
CVE-2020-11261 is a high-severity (CVSS 7.8) vulnerability in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables. CISA added it to the Known Exploited Vulnerabilities catalog on December 1, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 1, 2022. CISA does not currently list it as used in ransomware campaigns. Qualcomm has 12 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 12 known-exploited Qualcomm vulnerabilities →Description
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Qualcomm — Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Name: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
Date added: 2021-12-01 · Due: 2022-06-01
Required action: Apply updates per vendor instructions.