{"id":"CVE-2020-11261","kind":"vulnerability","aliases":["CVE-2020-11261"],"related":[],"title":"Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability","description":"Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables\n\nCISA required action: Apply updates per vendor instructions.","summary":"Qualcomm Snapdragon chipsets in automotive, mobile, wearable, IoT and connectivity products mishandle huge memory allocation requests, causing memory corruption. Per CISA it is known to be exploited in the wild, and the sources do not say what an attacker can do with the corruption.","severity":"high","cvss":7.8,"epss":0.01604,"exploited":true,"exploited_at":"2021-12-01T00:00:00+00:00","products":[{"name":"Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","automotive","embedded","exploited","infrastructure","iot","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the updates per Qualcomm vendor instructions (CISA required action). Specific patched versions: unknown.","status":"open","published_at":"2021-06-09T05:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:59+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:31:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Qualcomm vendor instructions (CISA required action). Specific patched versions: unknown.","reach":"local","impact":"high","summary":"Qualcomm Snapdragon chipsets in automotive, mobile, wearable, IoT and connectivity products mishandle huge memory allocation requests, causing memory corruption. Per CISA it is known to be exploited in the wild, and the sources do not say what an attacker can do with the corruption.","category":"infrastructure","who_cares":["qualcomm","android","embedded","automotive","iot"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory corruption could be triggered by a user application; code execution not stated in sources.","analyst_note":"Find Qualcomm's security bulletin for CVE-2020-11261 and confirm affected chipset/firmware versions, patch level, and whether the exploit gives code execution or privilege escalation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000508,"input_tokens":3093,"output_tokens":397,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find Qualcomm's security bulletin for CVE-2020-11261 and confirm affected chipset/firmware versions, patch level, and whether the exploit gives code execution or privilege escalation.","search":"'-11261':30A,33A '-2020':29A,32A 'action':146C 'alloc':75B,119C 'android':54B 'appli':147C 'applic':116C 'attack':99B 'auto':3A,36A,126C 'automot':55B,65B 'caus':77B 'check':110C 'chipset':23A,63B 'cisa':81B,144C 'comput':5A,128C 'compute':38A 'connect':7A,70B,130C 'connectivity':40A 'consum':9A,132C 'consumer':42A 'corrupt':79B,104B,106C 'cve':28A,31A 'due':107C 'embed':56B 'error':113C 'exploit':57B,87B 'huge':73B,122C 'improp':24A,109C 'industri':12A,135C 'industrial':45A 'infrastructur':58B 'input':25A 'instruct':151C 'iot':10A,13A,43A,46A,59B,68B,133C,136C 'known':84B 'memori':74B,78B,105C,118C 'mishandl':72B 'mobil':15A,66B,138C 'mobile':48A 'multipl':22A 'music':18A,51A,141C 'per':80B,149C 'product':71B 'qualcomm':1A,21A,34A,60B,61B 'request':76B,117C 'requir':145C 'return':112C 'say':96B 'size':123C 'snapdragon':2A,4A,6A,8A,11A,14A,16A,19A,35A,37A,39A,41A,44A,47A,49A,52A,62B,125C,127C,129C,131C,134C,137C,139C,142C 'sourc':93B 'updat':148C 'user':115C 'valid':26A 'vendor':150C 'voic':17A,140C 'voice':50A 'vulner':27A 'wearabl':20A,67B,143C 'wearables':53A 'wild':90B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-06-09T05:15:07+00:00","kev":{"dateAdded":"2021-12-01","dueDate":"2022-06-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-11261","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11261","severity":null,"published_at":"2021-12-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2020-11261","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11261","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-11261","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11261","severity":null,"published_at":"2021-06-09T05:15:07+00:00","modified_at":"2026-06-17T02:49:49+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}