Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Integer Overflow to Buffer Overflow in TZ Secure OS

Buffer Over-read in WLAN HOST

Memory corruption in modem due to buffer overflow while processing a PPP packet

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute,…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Over-read in Multi Mode Call Processor

Missing Authorization in Core

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in HLOS

Use After Free in HLOS

Improper Validation of Array Index in Hypervisor

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Double Free in HLOS

Use After Free in Kernel

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Buffer Copy Without Checking Size of Input in SPS Applications

Use of Out-of-range Pointer Offset in Audio

Improper Input Validation in Services

Use of Out-of-range Pointer Offset in PCIe

Buffer copy without checking size of Input in Core

Use After Free in Audio

Integer Overflow or Wraparound in Radio Interface Layer

Use of Out-of-range Pointer Offset in Audio

Integer Overflow or Wraparound in TZ Secure OS

Buffer Copy without Checking Size of Input in HLOS

NULL pointer dereference in WLAN Firmware

Integer Overflow to Buffer Overflow in User Identity Module

Buffer Copy Without Checking Size of Input in Boot

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Buffer Copy Without Checking Size of Input in Audio

Improper Authorization in HLOS

Improper Authentication in Core

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command

Memory corruption in WLAN HAL while parsing WMI command parameters

Memory corruption in WLAN HAL while handling command through WMI interfaces

Memory corruption in WLAN HAL while handling command streams through WMI interfaces

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload

Memory corruption in WLAN handler while processing PhyID in Tx status handler

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range