Use After Free in DSP Service

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while playing audio file having large-sized input buffer

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Integer Overflow or Wraparound in Display

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Missing Authorization in Core

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input

Memory corruption while processing identity credential operations in the trusted application

Memory corruption while copying packets received from unix clients

Memory corruption while performing encryption and decryption commands

Memory corruption while processing video packets received from video firmware

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption while running VK synchronization with KASAN enabled

Memory corruption in wearables while processing data from AON

Memory corruption while sending SMS from AP firmware

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption while parsing the ADSP response command

Memory Corruption in HLOS while registering for key provisioning notify

Memory corruption in Graphics while processing user packets for command submission

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD

Memory corruption due to stack-based buffer overflow in Core

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible out of bound read due to improper length calculation of WMI message