Use After Free in DSP Service

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while playing audio file having large-sized input buffer

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Memory corruption in video due to configuration weakness

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute,…

Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute,…

Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memory overflow' in Snapdragon Auto, Snapdragon…

u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…

An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Integer Overflow or Wraparound in Display

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Weak configuration in Automotive while VM is processing a listener request from TEE

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Missing Authorization in Core

Buffer Copy Without Checking Size of Input in Biometrics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input

Memory corruption while calculating offset from partition start point

Memory corruption when calculating oversized partition sizes without proper checks

Memory corruption while processing identity credential operations in the trusted application

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption while processing client message during device management

Memory corruption while performing encryption and decryption commands

Memory corruption while processing control commands in the virtual memory management interface

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while sound model registration for voice activation with audio kernel driver