Use After Free in DSP Service

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Integer Overflow or Wraparound in Display

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Buffer Over-read in Multi Mode Call Processor

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Computer Vision

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in Display

Incorrect Calculation of Buffer Size in HLOS

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing manipulated payload in video firmware

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while reading the FW response from the shared queue

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent buffer access due to modification of the reference count

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while processing command in Glink linux

Memory corruption while processing API calls to NPU with invalid input

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when keymaster operation imports a shared key

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when multiple listeners are being registered with the same file descriptor

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption while running VK synchronization with KASAN enabled

Memory corruption while sending SMS from AP firmware