Information disclosure in Qualcomm Snapdragon Mobile
Priority LOW 34CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, there could be leakage of protected contents if HLOS doesn't request for security restoration for OCMEM xPU's.
Why it matters now
EPSS 0.00839 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon Mobile | SD 400, SD 800 | — | No fix listed | CNA |
- Snapdragon Mobile VendorQualcomm Affected SD 400, SD 800 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd_400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd_800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd_800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-10055
- 2026-10-03 Alias added: GHSA-gjcm-jj24-9jc7
References
More Qualcomm Sd 400 Firmware vulnerabilities
- TI-2018-02629 Double free in Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
- TI-2017-13341 Use after free in Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
- TI-2017-13340 Memory corruption in Qualcomm Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
- TI-2017-13339 Memory corruption in Qualcomm Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
- TI-2017-13337 Use after free in Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
- TI-2017-13331 Out-of-bounds read in Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear CVSS 3.0CRITICAL 9.8
Sources
- CVE-2014-10055 · CVE Program
- CVE-2014-10055 · NVD
- FIRST EPSS
- GHSA-gjcm-jj24-9jc7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences