Buffer Over-read in WLAN HAL

Reachable Assertion in Modem

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon or probe response frame in STA

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Information disclosure in Network Services due to buffer over-read while the device receives DNS response

Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon…

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible buffer overflow due to lack of length check in BA request in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

Improper Input Validation in Trusted Execution Environment

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources in Snapdragon…

Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Use After Free in Windows WLAN Host

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Core Services

Possible out of bound access in audio module due to lack of validation of user provided input

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Out of Bounds write in Linux Camera

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile