Memory corruption during management frame processing due to mismatch in T2LM info element

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while redirecting log file to any file location with any file name

Memory corruption while redirecting log file to any file location with any file name

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption in WLAN Host while processing RRM beacon on the AP

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames

Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile,…

Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame…

Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapdragon Auto,…

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption while deinitializing a HDCP session

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface

Memory corruption when allocating and accessing an entry in an SMEM partition continuously

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image

Memory corruption while processing TPC target power table in FTM TPC

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region

Memory corruption in HLOS while running playready use-case

Memory corruption when processing cmd parameters while parsing vdev

Memory corruption in Kernel while parsing metadata

Memory Corruption in Core due to secure memory access by user while loading modem image

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command

Memory corruption in WLAN HAL while parsing WMI command parameters

Memory corruption in WLAN HAL while handling command through WMI interfaces

Memory corruption in WLAN HAL while handling command streams through WMI interfaces

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers