Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT,…

Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption while invoking IOCTL map buffer request from userspace

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Reachable Assertion in Modem

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Transient DOS while parsing video packets received from the video firmware

Transient DOS while processing video packets received from video firmware

There may be information disclosure during memory re-allocation in TZ Secure OS

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing information on firmware image during core initialization

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information disclosure in IOE Firmware while handling WMI command

Information disclosure in Kernel due to indirect branch misprediction

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation

Information Disclosure in Graphics during GPU context switch

Information disclosure due to buffer overread in Core

Information disclosure due to buffer overread in Core

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…