Read the docs
TI-2018-08035 Aliases CVE-2018-11280GHSA-67h5-5fjm-vp6q

Improper input validation in Qualcomm Android for MSM, Firefox OS for MSM, QRD Android

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur.

Why it matters now

EPSS 0.00196 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QualcommAndroid for MSM, Firefox OS for MSM, QRD AndroidAll Android releases from CAF using the Linux kernel—No fix listedCNA
  • Android for MSM, Firefox OS for MSM, QRD Android VendorQualcomm Affected All Android releases from CAF using the Linux kernel Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*not specified by NVDVulnerableGoogle
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Google

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11280
  2. 2026-10-03 Alias added: GHSA-67h5-5fjm-vp6q

References

Patch 2

  • TI-2025-15441 Incorrect Authorization in Graphics Windows KEVCVSS 3.1HIGH 8.6
  • TI-2025-15440 Incorrect Authorization in Graphics KEVCVSS 3.1HIGH 8.6
  • TI-2023-16287 Integer Overflow or Wraparound in Graphics Linux KEVCVSS 3.1HIGH 8.4
  • TI-2023-16286 Use of Out-of-range Pointer Offset in Graphics KEVCVSS 3.1HIGH 8.4
  • TI-2022-06419 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
  • TI-2021-01605 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
See all 3059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences