Use After Free in DSP Service

Use After Free in Graphics

Integer Overflow or Wraparound in GPS

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Missing Authentication for Critical Function in Data Modem

Buffer Copy Without Checking Size of Input in Automotive Platform

Buffer Over-read in Graphics

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in Audio

Use After Free in Video

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while reading the FW response from the shared queue

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption while sending SMS from AP firmware

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption while parsing the ADSP response command

Memory corruption in Linux while calling system configuration APIs

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to use after free in Modem while modem initialization

Memory corruption in WLAN due to use after free

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in Automotive Android OS due to improper input validation

Memory corruption in display due to double free while allocating frame buffer memory

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity,…

Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, Snapdragon Compute,…

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…

Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon…

Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity,…

Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT,…

Possible out of bound memory access due to improper boundary check while creating HSYNC fence in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…