Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Memory corruption while handling payloads from remote ESL

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Stack-based Buffer Overflow in WLAN Firmware

Memory corruption while decoding of OTA messages from T3448 IE

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information Disclosure while parsing beacon frame in STA

Information disclosure in Modem while processing SIB5

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Buffer Over-read in Windows Compute

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Use After Free in Automotive Audio

Use After Free in Secure Processor

Use of Uninitialized Variable in HLOS

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Audio

Memory corruption while encoding the image data

Memory corruption due to double free when multiple threads race to set the timestamp store

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption during the image encoding process

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing a private escape command in an event trigger

Memory corruption while operating the mailbox in Automotive

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API