Memory corruption during management frame processing due to mismatch in T2LM info element

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Information Disclosure while parsing beacon frame in STA

An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption while processing TPC target power table in FTM TPC

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Memory corruption while processing audio effects

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command

Memory corruption in WLAN HAL while parsing WMI command parameters

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload

Memory corruption in WLAN handler while processing PhyID in Tx status handler

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message

Memory Corruption in WLAN HOST while parsing QMI response message from firmware

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command

Possible out of bound read due to improper length calculation of WMI message

Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper validation of data length received from DMA buffer can lead to memory corruption

Buffer Over-read in WLAN Firmware

Transient DOS while creating NDP instance

Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS while parsing per STA profile in ML IE

Transient DOS may occur while parsing extended IE in beacon

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Host Cmn