Integer Overflow or Wraparound in Graphics Linux

Use After Free in DSP Services

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper Restriction of Operations within the Bounds of a Memory Buffer in Hypervisor

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Over-read in Multi Mode Call Processor

Out-of-bounds Write in Windows Compute

Double Free in SPS-HLOS

Cryptographic Issues in Automotive

Improper Input Validation in HLOS

Improper Input Validation in Automotive

Improper Access Control in Hypervisor

Improper Input Validation in Hypervisor

Improper Input Validation in Video Analytics and Processing

Improper Validation of Array Index in Hypervisor

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Use After Free in Computer Vision

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive

Permissions, Privileges, and Access Control issues in TZ Secure OS

Buffer Over-read in Trusted Execution Environment

Double Free in HLOS

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS

Improper Input Validation in Secure Processor

Use of Out-of-range Pointer Offset in Video

Access of Uninitialized Pointer in SPS Applications

Integer Overflow or Wraparound in HLOS

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of…

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled

Memory corruption in Core while processing control functions

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption while receiving a message in Bus Socket Transport Server

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption in HLOS while invoking IOCTL calls from user-space