Memory corruption while loading an ELF segment in TEE Kernel

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Use After Free in DSP_Services

Use After Free in DSP Service

Out-of-bounds Write in DSP Service

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Video

Out-of-bounds Write in Video

Buffer Over-read in Windows Compute

Out-of-bounds Write in DSP Service

Out-of-bounds Read in DSP Service

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Buffer Copy Without Checking Size of Input in Power Management IC

Use After Free in DSP Service

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Buffer Over-read in Camera

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Automotive

Memory Corruption when multiple threads concurrently access and modify shared resources

Memory corruption while processing a video session to set video parameters

Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing TPC target power table in FTM TPC

Memory corruption in Core Services while executing the command for removing a single event listener

Memory corruption in Core while processing control functions

Memory corruption when processing cmd parameters while parsing vdev

Memory corruption in Kernel while parsing metadata

Memory Corruption in Core due to secure memory access by user while loading modem image

Buffer Over-read in WLAN Firmware

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS while handling command data during power control processing

Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Buffer Over-read in WLAN Host Cmn

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame