Memory Corruption in Multi-mode Call Processor while processing bit mask API

Memory Corruption in Data Modem while making a MO call or MT VOLTE call

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Over-read in Multi Mode Call Processor

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory corruption while processing an IOCTL call to set mixer controls

Memory corruption while sound model registration for voice activation with audio kernel driver

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Return of Stack Variable Address in Buses

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released

Memory corruption while allocating memory in HGSL driver

Memory corruption while processing IOCTL call to set metainfo

Memory corruption when the payload received from firmware is not as per the expected protocol size

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when there is failed unmap operation in GPU

Memory corruption in Audio while processing the calibration data returned from ACDB loader

Memory corruption in Audio while processing IIR config data from AFE calibration block

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory Corruption in WLAN HOST while fetching TX status information

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool

Memory corruption in Graphics while importing a file