CVE-2015-9122: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon W...

Security readout for executives and security teams

This CVE affects Android devices using listed Qualcomm Snapdragon Mobile or Wear chipsets with security patch levels before April 5, 2018. A malicious or faulty SIM card response larger than 64KB could trigger a buffer overflow. The public bundle does not state impact, CVSS score, or confirmed exploitation. Exposure is most likely in older Android phones, embedded cellular devices, or wearables using the listed Qualcomm Snapdragon platforms and running a security patch level before April 5, 2018. Handle this as a legacy mobile and embedded device hygiene issue. Urgency rises if affected devices remain operational, handle sensitive data, or cannot be patched. Evidence is insufficient to claim active exploitation or business-critical emergency. Mitigation focus: Update affected Android devices to the April 5, 2018 security patch level or later.; Check OEM and Qualcomm guidance for model-specific firmware availability.; Retire or isolate unsupported affected devices that cannot receive security updates..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.