Use After Free in DSP Service

Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption during management frame processing due to mismatch in T2LM info element

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while playing audio file having large-sized input buffer

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Memory corruption in video due to configuration weakness

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Information Disclosure while parsing beacon frame in STA

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data

An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Cryptographic issue may occur while encrypting license data

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Weak configuration in Automotive while VM is processing a listener request from TEE

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in Graphics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

NULL Pointer Dereference in HLOS

Out-of-bounds Write in HLOS

Stack-based Buffer Overflow in Camera Driver