Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot…

Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Out of bound in camera driver due to lack of check of validation of array index before copying into array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…

Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile

Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snapdragon Compute, Snapdragon…

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Buffer Over-read in WLAN Firmware

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

Improper Input Validation in Modem

Reachable Assertion in Modem

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Insufficient Granularity of Access Control in Core

Buffer Over-read in WLAN HOST

Integer Overflow or Wraparound in WLAN Host Communication

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Information disclosure in Video while parsing mp2 clip with invalid section length

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame