{"schemaVersion":3,"id":"CVE-2020-11120","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"u'Calling thread may free the data buffer pointer that was passed to the callback and later when event loop executes the callback, data buffer may not be valid and will lead to use after free scenario' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8096AU, APQ8098, Bitra, Kamorta, MSM8917, MSM8953, MSM8998, QCM2150, QCS405, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM632, SM6150, SM7150, SM8150, SM8250, SXR2130","dates":{"published":"2020-09-08T09:31:36.000Z","modified":"2024-08-04T11:21:14.759Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.6,"severity":"medium","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0019,"percentile":0.08179,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.0019},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0019,"percentile":0.08179}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0019,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0019,"percentile":0.08179}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables","name":"Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","label":"snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"APQ8096AU, APQ8098, Bitra, Kamorta, MSM8917, MSM8953, MSM8998, QCM2150, QCS405, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM632, SM6150, SM7150, SM8150, SM8250, SXR2130","noFixRecorded":false,"fixedIn":null}],"versionsText":"APQ8096AU, APQ8098, Bitra, Kamorta, MSM8917, MSM8953, MSM8998, QCM2150, QCS405, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM632, SM6150, SM7150, SM8150, SM8250, SXR2130","eol":null,"hubHref":"/vendor/qualcomm_inc/snapdragon_auto_snapdragon_compute_snapdragon_consumer_iot_snapdragon_industrial_iot_snapdragon_mobile_snapdragon_voice__music_snapdragon_wearables"},{"vendor":"qualcomm","product":"apq8096au_firmware","name":"apq8096au firmware","label":"apq8096au_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/apq8096au"},{"vendor":"qualcomm","product":"apq8098_firmware","name":"apq8098 firmware","label":"apq8098_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/apq8098"},{"vendor":"qualcomm","product":"bitra_firmware","name":"bitra firmware","label":"bitra_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/bitra"},{"vendor":"qualcomm","product":"kamorta_firmware","name":"kamorta firmware","label":"kamorta_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/kamorta"},{"vendor":"qualcomm","product":"msm8917_firmware","name":"msm8917 firmware","label":"msm8917_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/msm8917"},{"vendor":"qualcomm","product":"msm8953_firmware","name":"msm8953 firmware","label":"msm8953_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/msm8953"},{"vendor":"qualcomm","product":"msm8998_firmware","name":"msm8998 firmware","label":"msm8998_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/msm8998"},{"vendor":"qualcomm","product":"qcm2150_firmware","name":"qcm2150 firmware","label":"qcm2150_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qcm2150"},{"vendor":"qualcomm","product":"qcs405_firmware","name":"qcs405 firmware","label":"qcs405_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qcs405"},{"vendor":"qualcomm","product":"qcs605_firmware","name":"qcs605 firmware","label":"qcs605_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qcs605"},{"vendor":"qualcomm","product":"qm215_firmware","name":"qm215 firmware","label":"qm215_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qm215"},{"vendor":"qualcomm","product":"rennell_firmware","name":"rennell firmware","label":"rennell_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/rennell"},{"vendor":"qualcomm","product":"saipan_firmware","name":"saipan firmware","label":"saipan_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/saipan"},{"vendor":"qualcomm","product":"sdm429_firmware","name":"sdm429 firmware","label":"sdm429_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sdm429"},{"vendor":"qualcomm","product":"sdm439_firmware","name":"sdm439 firmware","label":"sdm439_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sdm439"},{"vendor":"qualcomm","product":"sdm450_firmware","name":"sdm450 firmware","label":"sdm450_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sdm450"},{"vendor":"qualcomm","product":"sdm632_firmware","name":"sdm632 firmware","label":"sdm632_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sdm632"},{"vendor":"qualcomm","product":"sm6150_firmware","name":"sm6150 firmware","label":"sm6150_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sm6150"},{"vendor":"qualcomm","product":"sm7150_firmware","name":"sm7150 firmware","label":"sm7150_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sm7150"},{"vendor":"qualcomm","product":"sm8150_firmware","name":"sm8150 firmware","label":"sm8150_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sm8150"},{"vendor":"qualcomm","product":"sm8250_firmware","name":"sm8250 firmware","label":"sm8250_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sm8250"},{"vendor":"qualcomm","product":"sxr2130_firmware","name":"sxr2130 firmware","label":"sxr2130_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/sxr2130"}],"affectedCount":23,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin","label":"www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin","hostname":"www.qualcomm.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin","label":"www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin","hostname":"www.qualcomm.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-09-08T09:31:36.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T11:21:14.759Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:59:10.867Z","stale":false,"partial":false}}