Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Memory corruption while handling the PDR in driver for getting the remote heap maps

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon…

Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint pair and its size in Snapdragon Auto,…

Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Reachable Assertion in Modem

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Core Services

Buffer Over-read in Audio

Buffer Over-read in Automotive OS Platform Android

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in Video

Buffer Over-read in Video

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Information disclosure in WLAN HAL while handling command through WMI interfaces

Information disclosure in WLAN HAL while handling the WMI state info command

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Information Disclosure in Graphics during GPU context switch