What is CVE-2018-11858?

CVE-2018-11858 is a high-severity vulnerability in Qualcomm Sd 835, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-10-29.

How severe is CVE-2018-11858?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2018-11858 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Qualcomm Sd 835

CVE-2018-11858

When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version SD 835, SD 845, SD 850.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qualcomm Sd_835
Qualcomm Sd_835_firmware
Qualcomm Sd_845
Qualcomm Sd_845_firmware
Qualcomm Sd_850
Qualcomm Sd_850_firmware
Qualcomm, Inc. Snapdragon Mobile — versions SD 835, SD 845, SD 850

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

product-security@qualcomm.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-11858?: CVE-2018-11858 is a high-severity vulnerability in Qualcomm Sd 835, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-10-29.
How severe is CVE-2018-11858?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2018-11858 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.