Use After Free in DSP Service

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Integer Overflow or Wraparound in Display

Use After Free in SCE-Mink

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Weak configuration in Automotive while VM is processing a listener request from TEE

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Untrusted Pointer Dereference in Graphics

Missing Authorization in Core

Buffer Copy Without Checking Size of Input in Biometrics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Graphics

Exposed Dangerous Method or Function in HLOS

Integer Overflow or Wraparound in Automotive

Integer Overflow or Wraparound in Automotive

Use of Uninitialized Variable in HLOS

Use After Free in Automotive Linux OS

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption while processing client message during device management

Memory corruption while performing encryption and decryption commands

Memory corruption while processing control commands in the virtual memory management interface

Memory corruption while handling invalid inputs in application info setup

Memory corruption while processing data sent by FE driver

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit