Integer Overflow or Wraparound in Graphics Linux

Memory corruption in modem due to buffer overflow while processing a PPP packet

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute,…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Use After Free in DSP Service

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in HLOS

Memory corruption when allocating and accessing an entry in an SMEM partition continuously

Use After Free in DSP Service

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux

Memory corruption when there is failed unmap operation in GPU

Memory corruption in Audio while processing RT proxy port register driver

Memory corruption in Core Services while executing the command for removing a single event listener

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in WLAN HAL while handling command streams through WMI interfaces

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool

Memory corruption in Graphics while importing a file

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http

Memory corruption due to configuration weakness in modem wile sending command to write protected files

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content

Memory corruption in display due to double free while allocating frame buffer memory