Incorrect Authorization in Graphics Windows

Use After Free in DSP Service

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption while handling payloads from remote ESL

Memory corruption due to improper validation of array index in Multi-mode call processor

Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in Windows Compute

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Use After Free in Secure Processor

Use of Uninitialized Variable in HLOS

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Audio

Use After Free in Video

Memory corruption while encoding the image data

Memory corruption due to double free when multiple threads race to set the timestamp store

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption during the image encoding process

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing a private escape command in an event trigger

Memory corruption while operating the mailbox in Automotive

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while reading the FW response from the shared queue

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory