Memory corruption during management frame processing due to mismatch in T2LM info element

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while redirecting log file to any file location with any file name

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption in WLAN Host while processing RRM beacon on the AP

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Memory corruption while loading an ELF segment in TEE Kernel

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Use After Free in DSP_Services

Use After Free in DSP Service

Out-of-bounds Write in DSP Service

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Video

Out-of-bounds Write in Video

Buffer Over-read in Windows Compute

Out-of-bounds Write in DSP Service

Out-of-bounds Read in DSP Service

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Buffer Copy Without Checking Size of Input in Power Management IC

Use After Free in DSP Service

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Buffer Over-read in Camera

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Automotive

Double Free in Video

Untrusted Pointer Dereference in Video

Use After Free in DSP Service

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing TPC target power table in FTM TPC

Memory corruption in Core Services while executing the command for removing a single event listener

Memory corruption in Core while processing control functions

Memory corruption when processing cmd parameters while parsing vdev

Memory corruption in Kernel while parsing metadata

Memory Corruption in Core due to secure memory access by user while loading modem image

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN HAL

Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range