Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Improper length check of public exponent in RSA import key function could cause memory corruption

Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot…

Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snapdragon Compute, Snapdragon…

Information disclosure while creating MQ channels

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Data Modem during DTLS handshake

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem after RRC Setup message is received

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN Firmware while parsing a NAN management frame

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Information Disclosure in data Modem while parsing an FMTP line in an SDP message

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS in WLAN Firmware while processing frames with missing header fields

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to improper authorization in Modem

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported