Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Buffer Over-read in Multi Mode Call Processor

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.' in Snapdragon Auto, Snapdragon…

Out-of-bounds Write in Display

Incorrect Calculation of Buffer Size in HLOS

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while processing command in Glink linux

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Use After Free in Qualcomm IPC

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption in wearables while processing data from AON

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory corruption while processing audio effects

Memory corruption in Audio during playback session with audio effects enabled

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request

Memory Corruption due to improper validation of array index in Linux while updating adn record

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in RIL while trying to send apdu packet

Memory corruption in Linux while calling system configuration APIs

Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request

Memory corruption in Linux while sending DRM request

Memory corruption due to use after free in Modem while modem initialization

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment

Memory corruption in WLAN due to use after free

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in display due to double free while allocating frame buffer memory