Integer Overflow or Wraparound in Graphics Linux

Use After Free in DSP Services

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption in modem due to buffer overflow while processing a PPP packet

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute,…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Buffer Over-read in Multi Mode Call Processor

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics…

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in HLOS

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while processing API calls to NPU with invalid input

Crafted Binder Request Causes Heap UAF in MediaServer

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption in Audio while processing RT proxy port register driver

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of…

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory corruption in WLAN HAL while handling command streams through WMI interfaces

Memory corruption while allocating memory in COmxApeDec module in Audio

Memory Corruption in Audio while playing amrwbplus clips with modified content

Memory Corruption in Audio while allocating the ion buffer during the music playback

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption in Graphics while importing a file

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length