Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing user packets to generate page faults

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver

Use After Free in Qualcomm IPC

Untrusted Pointer Dereference in Computer Vision

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption in Kernel while handling GPU operations

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption while parsing the ADSP response command

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory corruption in Audio during playback session with audio effects enabled

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Linux while sending DRM request

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Memory corruption in Automotive Android OS due to improper validation of array index

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in display due to double free while allocating frame buffer memory

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon…

Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon…

Memory corruption in graphic driver due to use after free while calling multiple threads application to driver

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…