Incorrect Authorization in Graphics Windows

Use After Free in DSP Service

Use After Free in Graphics

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Memory corruption while handling payloads from remote ESL

Memory corruption due to improper validation of array index in Multi-mode call processor

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Stack-based Buffer Overflow in WLAN Firmware

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired…

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Missing Authentication for Critical Function in Data Modem

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Use After Free in DSP_Services

Use After Free in DSP Service

Use After Free in DSP Service

Use After Free in Graphics

Out-of-bounds Write in DSP Service

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Video

Buffer Over-read in Windows Compute

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations

Memory Corruption when retrieving output buffer with insufficient size validation

Memory corruption while preprocessing IOCTL request in JPEG driver