Memory corruption in core due to stack-based buffer overflow

Memory corruption in Core due to stack-based buffer overflow

Memory corruption in Automotive Android OS due to improper input validation

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command

Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer

Memory corruption in Automotive due to improper input validation

Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping

Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon Auto, Snapdragon…

Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value

Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption in multimedia due to improper check on the messages received

Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT,…

A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure while creating MQ channels

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Transient DOS while parsing per STA profile in ML IE

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Host Cmn

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Transient DOS while parsing ESP IE from beacon/probe response frame

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS while parse fils IE with length equal to 1

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host