Memory corruption while selecting the PLMN from SOR failed list

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE

Memory corruption due to improper validation of array index in Multi-mode call processor

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in video module due to buffer overflow while processing WAV file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT,…

Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption due to buffer overflow occurs while processing invalid MKV clip which has invalid seek header in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute,…

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Exposed Dangerous Method or Function in HLOS

Memory corruption while processing a malformed license file during reboot

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption in display driver while detaching a device

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption can occur in the camera when an invalid CID is used

Use After Free in Computer Vision

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while handling user packets during VBO bind operation

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory Corruption while accessing metadata in Display

Memory corruption in Audio while validating and mapping metadata

Memory corruption in Trusted Execution Environment while calling service API with invalid address

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions