LiveActive security incident?Get immediate response
CVE Record

CVE-2021-35078: Possible memory leak due to improper validation of certificate chain length while parsing server certificat...

Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-35078 is a Qualcomm Snapdragon vulnerability that can cause memory to leak when a device parses an overly long server certificate chain. The documented impact is availability, not data theft or tampering. Affected Snapdragon components span mobile, automotive, compute, IoT, connectivity, and wearable product lines.

Executive priority

Treat this as a high-priority availability risk for affected Snapdragon-based fleets, especially operational, IoT, automotive, and mobile environments. The main decision is patch availability through OEMs and carriers, not custom application remediation.

Technical view

The issue is improper validation of server certificate chain length during certificate parsing, leading to a possible memory leak. CVSS 3.1 is 7.5: network exploitable, low complexity, no privileges, no user interaction, unchanged scope, and high availability impact only.

Likely exposure

Exposure is most likely in products using the listed Qualcomm Snapdragon chipsets or connectivity/audio components. Business impact depends on whether OEM firmware includes Qualcomm's May 2022 security fixes and whether deployed devices parse untrusted server certificate chains.

Exploitation context

The provided sources do not report active exploitation, and this CVE is not marked as CISA KEV. The CVSS vector indicates remote network reachability without authentication or user interaction, but the bundle does not provide exploit details or real-world incident evidence.

Researcher notes

Evidence is limited to CVE data and Qualcomm's bulletin reference. No CWE is supplied. The affected list is broad and component-specific, so validation should focus on chipset and firmware lineage rather than product names alone.

Mitigation direction

  • Identify products using affected Qualcomm Snapdragon components.
  • Check Qualcomm May 2022 bulletin and OEM advisories for applicable fixes.
  • Apply OEM firmware, driver, or platform updates that include Qualcomm's fix.
  • Prioritize internet-connected, unmanaged, or safety-critical device fleets.
  • Monitor affected devices for memory exhaustion, crashes, or service degradation.

Validation and detection

  • Map device models to Qualcomm chipset identifiers in the affected list.
  • Verify installed firmware or patch level against OEM security advisories.
  • Confirm vendor documentation references CVE-2021-35078 or Qualcomm May 2022 fixes.
  • Review crash, reboot, and memory telemetry for unexplained availability issues.
  • Track exceptions where OEM firmware is unavailable or unsupported.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-35078 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2021-35078Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon WearablesAQT1000, AR8035, CSRB31024, QCA6174A, QCA6390, QCA6391, QCA6420, QCA6421, QCA6426, QCA6430, QCA6431, QCA6436, QCA6564AU, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCA9377, QCM2290, QCM4290, QCM6125, QCM6490, QCS2290, QCS410, QCS4290, QCS603, QCS605, QCS610, QCS6125, QCS6490, SA415M, SA515M, SC8180X+SDX55, SD 675, SD 8 Gen1 5G, SD 8CX, SD 8cx Gen2, SD460, SD480, SD662, SD665, SD670, SD675, SD678, SD680, SD690 5G, SD695, SD710, SD712, SD720G, SD730, SD750G, SD765, SD765G, SD768G, SD778G, SD780G, SD7c, SD855, SD865 5G, SD870, SD888, SD888 5G, SDX24, SDX50M, SDX55, SDX55M, SDX65, SDXR1, SDXR2 5G, SM4125, SM6250, SM6250P, SM7250P, SM7315, SM7325P, SW5100, SW5100P, WCD9326, WCD9335, WCD9340, WCD9341, WCD9360, WCD9370, WCD9371, WCD9375, WCD9380, WCD9385, WCN3910, WCN3950, WCN3980, WCN3988, WCN3990, WCN3991, WCN3998, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WSA8810, WSA8815, WSA8830, WSA8835Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.