Use After Free in DSP Service

Use of Out-of-range Pointer Offset in Graphics

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Integer Overflow or Wraparound in Display

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Missing Authorization in Core

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Exposed Dangerous Method or Function in HLOS

Use of Uninitialized Variable in HLOS

Buffer Copy Without Checking Size of Input in Core Services

Out-of-bounds Write in Windows Compute

Memory corruption while processing video packets received from video firmware

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption while running VK synchronization with KASAN enabled

Memory corruption in wearables while processing data from AON

Memory corruption while sending SMS from AP firmware

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption while parsing the ADSP response command

Memory Corruption in HLOS while registering for key provisioning notify

Memory corruption in Graphics while processing user packets for command submission

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD

Memory corruption due to stack-based buffer overflow in Core

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible out of bound read due to improper length calculation of WMI message

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session

Transient DOS may occur while processing the country IE

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA