VULNERABILITY INTELLIGENCE

CVE-2018-5849

CVSS score7 HIGH

EPSS probability0.12%

CISA KEVNot currently listed

Published2018-06-12

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free condition can occur.

Weakness classification

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416: Use After Free

Primary references

product-security@qualcomm.com — Patch, Third Party Advisory
nvd@nist.gov — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory