Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in Bluetooth Host while rfc slot allocation

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Stack-based Buffer Overflow in Display

Missing Cryptographic Step in Data Modem

Improper Input Validation in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Out-of-bounds Write in Camera Driver

Use After Free in Camera Driver

Use After Free in DSP Service

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Improper Input Validation in TZ Firmware

Out-of-bounds Read in Core

Out-of-bounds Read in Core

Improper Access Control for Register Interface in TZ Firmware

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Buffer Over-read in Video

Buffer Over-read in Core Services

Improper Authorization in SPS-HLOS

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction

Information disclosure due to buffer overread in Core