Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon or probe response frame in STA

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed

Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Verification of Cryptographic Signature in Boot

Information disclosure in Audio while accessing AVCS services from ADSP payload

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use

Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Memory corruption may occur in keyboard virtual device due to guest VM interaction

Memory corruption may occur while processing message from frontend during allocation

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Use After Free in HLOS

Buffer Copy Without Checking Size of Input in Audio

Out-of-bounds Write in Audio

Use After Free in HLOS

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Audio

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

Information disclosure while processing IO control commands

Information disclosure during audio playback

Information disclosure while processing information on firmware image during core initialization

Buffer Over-read in Automotive OS Platform

Buffer Over-read in Automotive Autonomy

Buffer Over-read in Audio

Buffer Over-read in Automotive Autonomy

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver