{"cve":"CVE-2014-9998","nvd":{"published":"2018-04-18T14:29:02.480","modified":"2026-06-17T00:19:23.887","status":"Modified","description":"In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 808, SD 810, SD 820, and SDX20, while processing firmware image signature, the internal buffer may overflow if the firmware signature size is large.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-119"],"references":["http://www.securityfocus.com/bid/103671","https://source.android.com/security/bulletin/2018-04-01","http://www.securityfocus.com/bid/103671","https://source.android.com/security/bulletin/2018-04-01"],"products":["qualcomm:ipq4019_firmware","qualcomm:ipq8064_firmware","qualcomm:mdm9206_firmware","qualcomm:mdm9607_firmware","qualcomm:mdm9635m_firmware","qualcomm:mdm9640_firmware","qualcomm:mdm9645_firmware","qualcomm:mdm9650_firmware","qualcomm:qca4531_firmware","qualcomm:qca6174a_firmware","qualcomm:qca6574au_firmware","qualcomm:qca6584_firmware","qualcomm:qca6584au_firmware","qualcomm:qca9377_firmware","qualcomm:qca9378_firmware","qualcomm:qca9379_firmware","qualcomm:qca9558_firmware","qualcomm:qca9880_firmware","qualcomm:qca9886_firmware","qualcomm:qca9980_firmware","qualcomm:sd_205_firmware","qualcomm:sd_210_firmware","qualcomm:sd_212_firmware","qualcomm:sd_425_firmware","qualcomm:sd_625_firmware","qualcomm:sd_808_firmware","qualcomm:sd_810_firmware","qualcomm:sd_820_firmware","qualcomm:sdx20_firmware"],"source":"nvd","synced_at":"2026-10-19T20:49:59.483420567+00:00"},"epss":{"cve":"CVE-2014-9998","score":0.01147,"percentile":0.66799,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}