What is CVE-2018-11854?

CVE-2018-11854 is a high-severity vulnerability in Qualcomm Sd 835, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-10-26.

How severe is CVE-2018-11854?

High severity. CVSS v3 base score is 7.8 out of 10.

Buffer overflow in Qualcomm Sd 835

CVE-2018-11854

Lack of check of valid length of input parameter may cause buffer overwrite in WLAN in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660

Vulnerability class: Buffer Overflow

Published 2018-10-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (13.6th percentile), scored 2026-10-03.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 13.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Qualcomm Sd 835
Qualcomm Sd 835 Firmware
Qualcomm Sd 845
Qualcomm Sd 845 Firmware
Qualcomm Sd 850
Qualcomm Sd 850 Firmware
Qualcomm Sda660
Qualcomm Sda660 Firmware
Qualcomm, Inc. Snapdragon Mobile — versions SD 835, SD 845, SD 850, SDA660

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

www.qualcomm.com/company/product-security/bulletins (Vendor Advisory)
www.securityfocus.com/bid/107681 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2018-11854?: CVE-2018-11854 is a high-severity vulnerability in Qualcomm Sd 835, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-10-26.
How severe is CVE-2018-11854?: High severity. CVSS v3 base score is 7.8 out of 10.