---
id: "CVE-2020-11261"
kind: "vulnerability"
aliases: ["CVE-2020-11261"]
title: "Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.01604
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "automotive", "embedded", "exploited", "infrastructure", "iot", "qualcomm"]
not_affected_if: ["unknown"]
published_at: "2021-06-09T05:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11261", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-11261", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11261", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Qualcomm Snapdragon chipsets in automotive, mobile, wearable, IoT and connectivity products mishandle huge memory allocation requests, causing memory corruption. Per CISA it is known to be exploited in the wild, and the sources do not say what an attacker can do with the corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables affected ? fixed ?

## Fix

Apply the updates per Qualcomm vendor instructions (CISA required action). Specific patched versions: unknown.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11261
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-11261
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-11261

## From the sources

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_