What is CVE-2015-9150?

CVE-2015-9150 is a critical-severity vulnerability in Qualcomm Mdm9625, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-04-18.

How severe is CVE-2015-9150?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Qualcomm Mdm9625

CVE-2015-9150

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, while computing the length of memory allocated for a Diag event, if the buffer length is very small or greater than the maximum, an integer overflow may occur, which later results in a buffer overflow.

Vulnerability class: Buffer Overflow

Published 2018-04-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.014 (71.8th percentile), scored 2026-09-28.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 71.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: -0.000

Affected products

Qualcomm Mdm9625
Qualcomm Mdm9625 Firmware
Qualcomm Mdm9635m
Qualcomm Mdm9635m Firmware
Qualcomm Sd 400
Qualcomm Sd 400 Firmware
Qualcomm Sd 800
Qualcomm Sd 800 Firmware
Qualcomm, Inc. Snapdragon Mobile — versions MDM9625, MDM9635M, SD 400, SD 800

Weakness classification (CWE)

References

source.android.com/security/bulletin/2018-04-01 (Vendor Advisory)
www.securityfocus.com/bid/103671 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2015-9150?: CVE-2015-9150 is a critical-severity vulnerability in Qualcomm Mdm9625, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-04-18.
How severe is CVE-2015-9150?: Critical severity. CVSS v3 base score is 9.8 out of 10.