Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Integer Overflow or Wraparound in GPS

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in modem due to buffer overflow while processing a PPP packet

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Missing Authentication for Critical Function in Data Modem

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Use After Free in DSP Service

Untrusted Pointer Dereference in Graphics

Missing Authorization in Core

Out-of-bounds Write in HLOS

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Buffer Copy Without Checking Size of Input in Automotive Platform

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Graphics

Improper Release of Memory Before Removing Last Reference in Graphics

Use of Uninitialized Variable in HLOS

Integer Overflow or Wraparound in Audio

Use After Free in Automotive Linux OS

Buffer Copy Without Checking Size of Input in Core Services

Out-of-bounds Write in Audio

Use After Free in Video

Incorrect Calculation of Buffer Size in HLOS

Buffer Copy Without Checking Size of Input in HLOS

Improper Access Control in Automotive Multimedia

Incorrect Calculation of Buffer Size in Video

Double Free in SPS-HLOS

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Computer Vision

Use After Free in GPS HLOS Driver

Out-of-bounds Write in SPS Applications

Use After Free in NPU

NULL Pointer Dereference in Display

Improper Validation of Array Index in Audio

Improper Validation of Array Index in Camera

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio