CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-10448
Critical (9.8) in qualcomm. EPSS 0.9% chance of exploitation in the next 30 days.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, a simultaneous command post for addSA or updateSA on same SA leads to memory corruption. APIs addSA and updateSA APIs access the global variable ipsec_sa_list[] outside of mutex protection.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- qualcomm:mdm9206_firmware
- qualcomm:mdm9607_firmware
- qualcomm:mdm9615_firmware
- qualcomm:mdm9625_firmware
- qualcomm:mdm9635m_firmware
- qualcomm:mdm9640_firmware
- qualcomm:mdm9645_firmware
- qualcomm:mdm9650_firmware
- qualcomm:mdm9655_firmware
- qualcomm:msm8909w_firmware
- qualcomm:sd_205_firmware
- qualcomm:sd_210_firmware
- qualcomm:sd_212_firmware
- qualcomm:sd_400_firmware
- qualcomm:sd_410_firmware
- qualcomm:sd_412_firmware
- qualcomm:sd_415_firmware
- qualcomm:sd_425_firmware
- qualcomm:sd_430_firmware
- qualcomm:sd_450_firmware
- qualcomm:sd_615_firmware
- qualcomm:sd_616_firmware
- qualcomm:sd_617_firmware
- qualcomm:sd_625_firmware
- qualcomm:sd_650_firmware
- qualcomm:sd_652_firmware
- qualcomm:sd_800_firmware
- qualcomm:sd_808_firmware
- qualcomm:sd_810_firmware
- qualcomm:sd_820_firmware
- qualcomm:sd_835_firmware
- qualcomm:sd_845_firmware
- qualcomm:sd_850_firmware
- qualcomm:sdx20_firmware