Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Improper length check of public exponent in RSA import key function could cause memory corruption

Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

Improper Input Validation in Modem

Reachable Assertion in Modem

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Insufficient Granularity of Access Control in Core

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Host Cmn

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS while parsing the received TID-to-link mapping action frame

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Information disclosure in Video while parsing mp2 clip with invalid section length

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR