Use of Out-of-range Pointer Offset in Graphics

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute,…

An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Exposed Dangerous Method or Function in HLOS

Use After Free in Video

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption in display driver while detaching a device

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events

Memory corruption while allocating memory in HGSL driver

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem

Memory corruption while invoking IOCTLs calls in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments

Memory corruption while running VK synchronization with KASAN enabled

Memory corruption in wearables while processing data from AON

Memory corruption in Core while processing RX intent request

Memory corruption in Audio while running invalid audio recording from ADSP

Memory Corruption in Audio while invoking callback function in driver from ADSP

Memory corruption while invoking callback function of AFE from ADSP

Memory corruption while parsing the ADSP response command

Memory corruption in DSP Service during a remote call from HLOS to DSP

Improper Access to the VM resource manager can lead to Memory Corruption

Memory corruption in Graphics while processing user packets for command submission

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory Corruption in Core Platform while printing the response buffer in log

Memory corruption in Core Platform while printing the response buffer in log

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode

Memoru corruption in Audio when ADSP sends input during record use case

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory

Memory corruption due to stack-based buffer overflow in Core