Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Use After Free in DSP Service

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Memory corruption due to use after free in service while trying to access maps by different threads in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT,…

Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in Snapdragon Auto, Snapdragon Compute,…

Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon…

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Improper Input Validation in TZ Firmware

Improper Access Control for Register Interface in TZ Firmware

Transient DOS while parsing BTM ML IE when per STA profile is not included

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check

Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Weak Authentication in HLOS

Buffer Over-read in Core Services

Buffer Over-read in Automotive OS Platform Android

Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in Video

Untrusted Pointer Dereference in TZ Firmware

Buffer Over-read in Video

Improper Authorization in SPS-HLOS

Buffer Over-read in Automotive Multimedia

Buffer Over-read in Audio

Buffer Over-read in Audio

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis

Information disclosure in Kernel due to indirect branch misprediction

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation