Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Integer Overflow or Wraparound in GPS

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in modem due to buffer overflow while processing a PPP packet

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Missing Authentication for Critical Function in Data Modem

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Use After Free in DSP Service

Untrusted Pointer Dereference in Graphics

Missing Authorization in Core

Out-of-bounds Write in HLOS

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption while processing identity credential operations in the trusted application

Memory corruption while routing GPR packets between user and root when handling large data packet

Memory corruption while handling IOCTL calls to set mode

Memory corruption while copying packets received from unix clients

Memory corruption while processing MFC channel configuration during music playback

Memory corruption during video playback when video session open fails with time out error

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while performing private key encryption in trusted application

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing video packets received from video firmware

Memory corruption while retrieving the CBOR data from TA

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while reading the FW response from the shared queue

Memory corruption while reading secure file

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption in display driver while detaching a device

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption while power-up or power-down sequence of the camera sensor

Use After Free in DSP Services

Use After Free in DSP Service

Return of Stack Variable Address in Buses