Integer Overflow or Wraparound in Graphics Linux

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption in modem due to buffer overflow while processing a PPP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute,…

Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206,…

In Snapdragon (Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD…

While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear

While parsing an mp4 file, an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear

While parsing an mp4 file, a stack-based buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

While processing modem SSR after IMS is registered, the IMS data daemon is restarted but the ipc_dataHandle is no longer available

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Weak configuration in Automotive while VM is processing a listener request from TEE

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics…

Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute,…

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in SCE-Mink

Incorrect Calculation of Buffer Size in HLOS

Improper Access Control in Automotive Multimedia

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption while processing input message passed from FE driver

Integer Overflow to Buffer Overflow in Automotive OS Platform

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption in Audio while processing the calibration data returned from ACDB loader

Memory corruption in Audio while processing IIR config data from AFE calibration block

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory corruption in Audio while processing the VOC packet data from ADSP