# CVE-2020-11261: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Source: https://junglewise.ai/threats/cve-2020-11261-qualcomm-multiple-chipsets-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-11261 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2021-12-01

A memory corruption vulnerability exists in multiple Qualcomm Snapdragon chipsets due to improper input validation when a user application requests a very large memory allocation. This flaw allows for potential out-of-bounds writes and has been observed being exploited in the wild.

Technologies: [Qualcomm Snapdragon Auto](https://junglewise.ai/threats/technologies/snapdragon-auto), [Qualcomm Snapdragon Compute](https://junglewise.ai/threats/technologies/snapdragon-compute), [Qualcomm Snapdragon Connectivity](https://junglewise.ai/threats/technologies/snapdragon-connectivity), [Qualcomm Snapdragon Consumer IOT](https://junglewise.ai/threats/technologies/snapdragon-consumer-iot), [Qualcomm Snapdragon Industrial IOT](https://junglewise.ai/threats/technologies/snapdragon-industrial-iot), [Qualcomm Snapdragon Mobile](https://junglewise.ai/threats/technologies/snapdragon-mobile), [Qualcomm Snapdragon Wearables](https://junglewise.ai/threats/technologies/snapdragon-wearables). Vendors: [Qualcomm](https://junglewise.ai/threats/vendors/qualcomm).

## Quick answers

**Is CVE-2020-11261 exploited in the wild?** Yes. CVE-2020-11261 is known to be exploited in the wild, first recorded on 1 December 2021. Treat it as urgent.

**How severe is CVE-2020-11261?** Critical severity, with a CVSS score of 7.8, published 1 December 2021.

**Which products and versions are affected?** Qualcomm Snapdragon Auto; Qualcomm Snapdragon Compute; Qualcomm Snapdragon Connectivity; Qualcomm Snapdragon Consumer IOT; and 6 more.

**Is there a fix for CVE-2020-11261?** A patch was published on 2021-01-01: Qualcomm January 2021 Bulletin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-11261 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2020-11261?** Check whether you run Qualcomm Music, Qualcomm Snapdragon Auto, Qualcomm Snapdragon Compute or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Qualcomm Snapdragon Auto
- Qualcomm Snapdragon Compute
- Qualcomm Snapdragon Connectivity
- Qualcomm Snapdragon Consumer IOT
- Qualcomm Snapdragon Industrial IOT
- Qualcomm Snapdragon Mobile
- Qualcomm Snapdragon Voice & Music
- Qualcomm Snapdragon Wearables
- Qualcomm APQ8009 Firmware
- Qualcomm APQ8009W Firmware

## Timeline

- 2021-01-01: patched: Qualcomm January 2021 Bulletin
- 2021-12-01: disclosed
- 2021-12-01: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2021-12-01: exploited: Reported as exploited in the wild at time of publication.

## Related threats

- [Qualcomm Snapdragon memory corruption in HT40 channel switching](https://junglewise.ai/threats/cve-2026-25268-qualcomm-snapdragon-memory-corruption-in-ht40-channel-switching)
- [Qualcomm Snapdragon memory corruption in memory allocation](https://junglewise.ai/threats/cve-2026-21379-qualcomm-snapdragon-memory-corruption-in-memory-allocation)
- [Qualcomm Snapdragon memory corruption via TOCTOU in shared buffers](https://junglewise.ai/threats/cve-2026-25260-qualcomm-snapdragon-memory-corruption-via-toctou-in-shared)
- [Qualcomm Chipset memory corruption in IOCTL escape operations](https://junglewise.ai/threats/cve-2026-25259-qualcomm-chipset-memory-corruption-in-ioctl-escape-operations)
- [Qualcomm Snapdragon memory corruption in IOCTL escape operations](https://junglewise.ai/threats/cve-2026-25258-qualcomm-snapdragon-memory-corruption-in-ioctl-escape-operations)