CVE-2018-11287 — In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, incorrect control flow implementation in Video while checking buffer sufficiency

Back Back to CVE browser

CRITICAL

In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, incorrect control flow implementation in Video while checking buffer sufficiency

Published Sep 20, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 0.94%

Description

In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, incorrect control flow implementation in Video while checking buffer sufficiency.

Affected products

Vendor Qualcomm, Inc. Product Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Default
n/a
- Version
  MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Qualcomm, Inc.

Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear

n/a

Version	Status	Constraints
MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016	affected	-

Remediation

No remediation recorded yet.

Metrics

0.94% 0.00942

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00942

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.94% (0.00942)	59.56th	v5 (v2026.06.15)
Sep 20, 2026	0.94% (0.00942)	59.44th	v5 (v2026.06.15)
Jul 20, 2024	0.21% (0.00207)	59.18th	v3 (v2023.03.01)
Jun 14, 2024	0.21% (0.00207)	58.93th	v3 (v2023.03.01)
Mar 7, 2023	0.21% (0.00207)	56.89th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.62% (0.00624)	17.80th	v5 (v2026.06.15)
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
x_refsource_CONFIRMVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components		x_refsource_CONFIRMVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins		x_refsource_CONFIRMVendor Advisory