CVE-2014-9974: In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer length...

Security readout for executives and security teams

This CVE concerns missing buffer length validation in Qualcomm Keymaster code used by Android releases from CAF with the Linux kernel. The source bundle does not provide severity, CVSS, CWE, exploitation details, or a named standalone fix, so urgency should be driven by affected device inventory and vendor bulletin coverage. Exposure is most likely on Qualcomm-based Android devices or firmware derived from the affected CAF Linux kernel releases. Exact exposure depends on OEM build lineage, Android security patch level, and whether the device includes the vulnerable Keymaster implementation. Set priority after inventory. The issue touches security-sensitive Keymaster code, but public evidence here lacks severity and exploitation detail. Organizations with unmanaged or unsupported Qualcomm Android fleets should treat this as a patch governance and lifecycle risk. Mitigation focus: Check Qualcomm, Android, and OEM advisories for CVE-2014-9974 coverage.; Apply OEM firmware or Android security updates that address the July 2017 bulletin issue.; Prioritize supported devices with Keymaster and Qualcomm CAF-derived Android builds..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.