What is CVE-2019-14091?

CVE-2019-14091 is a high-severity vulnerability in Qualcomm Mdm9607, classified under Double Free. CVSS score: 7.8/10. Published 2020-06-22.

How severe is CVE-2019-14091?

High severity. CVSS v3 base score is 7.8 out of 10.

Double Free in Qualcomm Mdm9607

CVE-2019-14091

Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, QCS405, Rennell, Saipan, SC8180X, SDX55, SM8150, SM8250, SXR2130

Vulnerability class: Double Free

EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qualcomm Mdm9607
Qualcomm Mdm9607_firmware
Qualcomm Qcs405
Qualcomm Qcs405_firmware
Qualcomm Rennell
Qualcomm Rennell_firmware
Qualcomm Saipan
Qualcomm Saipan_firmware
Qualcomm Sc8180x
Qualcomm Sc8180x_firmware

Weakness classification (CWE)

CWE-415 — Double Free
CWE-667 — Improper Locking

References

product-security@qualcomm.com (x_refsource_CONFIRM, Broken Link)
nvd@nist.gov (Vendor Advisory)

Frequently asked questions

What is CVE-2019-14091?: CVE-2019-14091 is a high-severity vulnerability in Qualcomm Mdm9607, classified under Double Free. CVSS score: 7.8/10. Published 2020-06-22.
How severe is CVE-2019-14091?: High severity. CVSS v3 base score is 7.8 out of 10.