What is CVE-2015-9196?

CVE-2015-9196 is a critical-severity vulnerability in Qualcomm Fsm9055, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2018-04-18.

How severe is CVE-2015-9196?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Improper input validation in Qualcomm Fsm9055

CVE-2015-9196

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Small Cell SoC FSM9055, MDM9635M, SD 400, and SD 800, improper input validation in tzbsp_ocmem can cause privilege escalation.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2018-04-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.015 (72.4th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: -0.000

Affected products

Qualcomm Fsm9055
Qualcomm Fsm9055 Firmware
Qualcomm Mdm9635m
Qualcomm Mdm9635m Firmware
Qualcomm Sd 400
Qualcomm Sd 400 Firmware
Qualcomm Sd 800
Qualcomm Sd 800 Firmware
Qualcomm, Inc. Snapdragon Mobile, Small Cell Soc — versions FSM9055, MDM9635M, SD 400, SD 800

Weakness classification (CWE)

References

source.android.com/security/bulletin/2018-04-01 (Vendor Advisory)
www.securityfocus.com/bid/103671 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2015-9196?: CVE-2015-9196 is a critical-severity vulnerability in Qualcomm Fsm9055, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2018-04-18.
How severe is CVE-2015-9196?: Critical severity. CVSS v3 base score is 9.8 out of 10.