Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon…

Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in turn can lead to heap corruption in Snapdragon Compute,…

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Copy Without Checking Size of Input in Audio

Use After Free in Data Network Stack & Connectivity

Out-of-bounds Write in Audio

Use After Free in HLOS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device

Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile

Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto,…

Weak Authentication in HLOS

Buffer Over-read in Neural Processing Unit

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Improper Authorization in SPS-HLOS

Buffer Over-read in Audio

Buffer Over-read in Audio

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Information disclosure in Automotive multimedia due to buffer over-read

Information disclosure in DSP Services while loading dynamic module

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation

Information Disclosure in Graphics during GPU context switch

Information disclosure due to buffer overread in Core