Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

While processing modem SSR after IMS is registered, the IMS data daemon is restarted but the ipc_dataHandle is no longer available

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Weak configuration in Automotive while VM is processing a listener request from TEE

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics…

Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute,…

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in SCE-Mink

Incorrect Calculation of Buffer Size in HLOS

Improper Access Control in Automotive Multimedia

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption while processing input message passed from FE driver

Integer Overflow to Buffer Overflow in Automotive OS Platform

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption in Audio while processing the calibration data returned from ACDB loader

Memory corruption in Audio while processing IIR config data from AFE calibration block

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer

Memory corruption while processing audio effects

Memory corruption in Graphics while processing user packets for command submission

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload

Memory corruption in Audio during playback session with audio effects enabled

Memory corruption while allocating memory in COmxApeDec module in Audio

Memory Corruption in Audio while playing amrwbplus clips with modified content

Memory corruption due to untrusted pointer dereference in automotive during system call

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Audio while allocating the ion buffer during the music playback

Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request