Read the docs
TI-2020-03198 Aliases CVE-2020-3671GHSA-cf3m-2v8x-jmm5

Use after free in Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Priority MEDIUM 44CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, Nicobar, QCM2150, QCS405, Saipan, SDM845, SM8150, SM8250, SXR2130

Why it matters now

EPSS 0.0091 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QualcommSnapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & MusicAPQ8009, Nicobar, QCM2150, QCS405, Saipan, SDM845, SM8150, SM8250, SXR2130—No fix listedCNA
  • Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music VendorQualcomm Affected APQ8009, Nicobar, QCM2150, QCS405, Saipan, SDM845, SM8150, SM8250, SXR2130 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:nicobar_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:nicobar:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:qcm2150_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:qcm2150:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:saipan_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:saipan:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
  • cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:nicobar_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:nicobar:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:qcm2150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:qcm2150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:saipan_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:saipan:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:sdm845:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:sm8150:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:sm8250:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableQualcomm
cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*not specified by NVDRunning onQualcomm
  • cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:sdm845:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:sm8150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:sm8250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
  • cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
  • cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-3671
  2. 2026-10-03 Alias added: GHSA-cf3m-2v8x-jmm5

References

Advisory 1

Other 1

  • TI-2021-01605 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
  • TI-2023-16248 Use After Free in DSP Services KEVCVSS 3.1HIGH 7.8
  • TI-2020-09124 Improper input validation in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… KEVCVSS 3.1HIGH 7.8
  • TI-2021-01606 Improper handling of address deregistration on failure can lead to new GPU address… KEVCVSS 3.1MEDIUM 6.2
  • TI-2020-03185 Buffer overflow in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… CVSS 3.1CRITICAL 9.8
  • TI-2020-09163 Improper authentication in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.1
See all 347 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences