Use After Free in DSP Service

Use After Free in Graphics

Memory corruption while processing specific files in Powerline Communication Firmware

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE

Memory corruption in modem due to improper length check while copying into memory

Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music

Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Cryptographic issue occurs due to use of insecure connection method while downloading

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Cryptographic issue may occur while encrypting license data

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Buffer Over-read in Windows Compute

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in HLOS

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Stack-based Buffer Overflow in Camera Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory Corruption when processing invalid user address with nonstandard buffer address

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory Corruption when multiple threads simultaneously access a memory free API

Memory corruption occurs when a secure application is launched on a device with insufficient memory

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations

Memory corruption while passing pages to DSP with an unaligned starting address

Memory corruption while deinitializing a HDCP session

Memory Corruption when processing IOCTLs for JPEG data without verification

Memory corruption while routing GPR packets between user and root when handling large data packet

Memory corruption during video playback when video session open fails with time out error

Memory corruption while allocating buffers in DSP service