Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdragon Compute, Snapdragon Auto, Snapdragon…

Use After Free in Video

Use of Out-of-range Pointer Offset in Camera Driver

Improper Input Validation in Audio

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon…

Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint pair and its size in Snapdragon Auto,…

Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Copy Without Checking Size of Input in Audio

Use After Free in Data Network Stack & Connectivity

Out-of-bounds Write in Audio

Use After Free in HLOS

Buffer Over-read in Hypervisor

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile,…

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Audio

Buffer Over-read in Neural Processing Unit

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in Video

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

Buffer Over-read in Automotive Multimedia

Buffer Over-read in Audio

Buffer Over-read in Computer Vision

Buffer Over-read in Audio

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information disclosure in WLAN HAL while handling the WMI state info command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Information disclosure in Automotive multimedia due to buffer over-read

Information disclosure in DSP Services while loading dynamic module

Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation

Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file