Incorrect Authorization in Graphics

Use After Free in Graphics

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Cryptographic issue occurs due to use of insecure connection method while downloading

Memory corruption while decoding of OTA messages from T3448 IE

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Cryptographic issue may occur while encrypting license data

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Use After Free in DSP Service

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in HLOS

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory Corruption when accessing trusted execution environment without proper privilege check

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption occurs when a secure application is launched on a device with insufficient memory

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations

Memory corruption while passing pages to DSP with an unaligned starting address

Memory corruption while deinitializing a HDCP session

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while processing MFC channel configuration during music playback

Memory corruption while allocating buffers in DSP service

Memory corruption while processing user buffers

Memory corruption while handling invalid inputs in application info setup

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption when programming registers through virtual CDM

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption during the FRS UDS generation process

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline