Memory corruption in DSP Service during a remote call from HLOS to DSP

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory corruption in Graphics while processing user packets for command submission

Memory Corruption in Core Platform while printing the response buffer in log

Memory corruption in Core Platform while printing the response buffer in log

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption in Linux Networking due to double free while handling a hyp-assign

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment

Memory corruption due to double free in core while initializing the encryption key

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory

Memory corruption due to stack-based buffer overflow in Core

Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking

Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon…

Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Over-read in BT Controller

Reachable Assertion in WLAN Firmware

Improper Input Validation in Modem

Buffer Over-read in WLAN Host Communication

Buffer Copy Without Checking Size of Input in WLAN Host

Buffer Over-read in WLAN HOST

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor

Buffer Over-read in WLAN Host Communication

Reachable Assertion in Data Modem

Incorrect Type Conversion or Cast in Multi-Mode Call Processor

Improper input validation in Multi-Mode Call Processor

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element