VulnerabilityModified

CVE-2019-14131

CRITICAL 9.8EPSS 0.91%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, MSM8998, Nicobar, QCA6574AU, QCS605, Rennell, SA6155P, Saipan, SC8180X, SDM660, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.91% probability · 60th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-787
Affected: qualcomm/apq8053 firmware · qualcomm/apq8096au firmware · qualcomm/msm8998 firmware · qualcomm/nicobar firmware · qualcomm/qca6574au firmware · qualcomm/qcs605 firmware · qualcomm/rennell firmware · qualcomm/sa6155p firmware · qualcomm/saipan firmware · qualcomm/sc8180x firmware · qualcomm/sdm660 firmware · qualcomm/sdm710 firmware · qualcomm/sdm845 firmware · qualcomm/sdx20 firmware · qualcomm/sdx24 firmware · qualcomm/sdx55 firmware · qualcomm/sm6150 firmware · qualcomm/sm7150 firmware · qualcomm/sm8150 firmware · qualcomm/sm8250 firmware · +1 more
Source: product-security@qualcomm.com

EPSS trend

EPSS 0.9% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletinPatch, Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletinPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.