Use After Free in DSP Service

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Integer Overflow or Wraparound in Display

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Weak configuration in Automotive while VM is processing a listener request from TEE

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Untrusted Pointer Dereference in Graphics

Missing Authorization in Core

Buffer Copy Without Checking Size of Input in Biometrics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

Use After Free in Automotive GPU

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input

Memory corruption while calculating offset from partition start point

Memory corruption when calculating oversized partition sizes without proper checks

Memory corruption while processing identity credential operations in the trusted application

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while handling IOCTL calls to set mode

Memory corruption while copying packets received from unix clients

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption while processing client message during device management

Memory corruption while performing encryption and decryption commands

Memory corruption while processing control commands in the virtual memory management interface

Memory corruption while handling invalid inputs in application info setup

Memory corruption while processing data sent by FE driver

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while reading the FW response from the shared queue

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application