Use of Out-of-range Pointer Offset in Graphics

Use After Free in Graphics

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response

Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute,…

Cryptographic issue occurs due to use of insecure connection method while downloading

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Untrusted Pointer Dereference in TZ Firmware

Use of Out-of-range Pointer Offset in TZ Firmware

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Missing Authorization in Core

Out-of-bounds Write in HLOS

Buffer Copy Without Checking Size of Input in Automotive Audio

Stack-based Buffer Overflow in Camera Driver

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Graphics

Integer Overflow or Wraparound in Audio

Use After Free in Automotive Linux OS

Buffer Copy Without Checking Size of Input in Core Services

Use After Free in Video

Buffer Copy Without Checking Size of Input in Computer Vision

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while processing command in Glink linux

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption while Configuring the SMR/S2CR register in Bypass mode

Use After Free in DSP Services

Return of Stack Variable Address in Buses

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events

Memory corruption while allocating memory in HGSL driver

Memory corruption while processing IOCTL call to set metainfo

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption when an invoke call and a TEE call are bound for the same trusted application

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem

Memory corruption while invoking IOCTLs calls in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command