Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapdragon Compute,…

Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute,…

During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer with physical address information in…

There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU opcodes to be…

Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…

String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminated before string copy in Snapdragon Auto,…

Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free issue in Snapdragon Auto, Snapdragon…

While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in Snapdragon Auto, Snapdragon Compute,…

Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware

Improper Access Control for RPU write access from secure processor in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…

Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid stack memory in Snapdragon Auto, Snapdragon Consumer IOT,…

Out of bound access can occur while processing peer info in IBSS connection mode due to lack of upper bounds check to ensure that for loop further will not cause an overflow in…

Possibility of out of bound access in debug queue, if packet size field is corrupted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handlers in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible OOB issue in EEPROM due to lack of check while accessing memory map array at the time of reading operation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer…

Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto,…

Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eventually will lead to buffer overwrite…

Use after free of a pointer in iWLAN scenario during netmgr state transition to CONNECT in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Snapdragon Consumer…

When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer overflow will happen in both cds_is_mmie_valid and…

Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application

Out of bound access due to lack of check of whiltelist array size while reading the image elf segments

Out-of-bounds memory access in Qurt kernel function when using the identifier to access Qurt kernel buffer to retrieve thread data

Improper Input Validation in Modem

Reachable Assertion in Modem

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor

Buffer Over-read in Audio

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN HOST

Incorrect Type Conversion or Cast in Multi-Mode Call Processor

Improper Input Validation in Multi-Mode Call Processor

Improper input Validation in Multi-Mode Call Processor

Reachable Assertion in Multi-Mode Call Processor

Reachable Assertion in Multi-Mode Call Processor

Improper Input Validation in Multi-Mode Call Processor

Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor

Reachable Assertion in Data Modem

Improper Input Validation in Modem

Improper Authentication in Data Modem

Reachable Assertion in Modem

Reachable Assertion in Modem

Buffer Over-read in Audio

Buffer Over-read in WLAN HOST

Improper authentication in Modem

Reachable assertion in Modem