Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Over-read in WLAN HAL

Buffer Over-read in BT Controller

Reachable Assertion in WLAN Firmware

Improper Input Validation in Modem

Buffer Over-read in WLAN HAL

Transient DOS may occur while processing the country IE

Information disclosure while parsing the OCI IE with invalid length

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Buffer Over-read in WLAN Firmware

Information disclosure while handling beacon probe frame during scan entry generation in client side

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in Data Modem during DTLS handshake

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Transient DOS in Modem while processing RRC reconfiguration message

Transient DOS in Modem while processing invalid System Information Block 1

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS in WLAN Firmware while parsing FT Information Elements

Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Transient DOS due to buffer over-read in WLAN while sending a packet to device

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes

Transient DOS in modem due to reachable assertion