Use After Free in DSP Service

Use After Free in Graphics

Integer Overflow or Wraparound in GPS

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Use After Free in Graphics Linux

Buffer Over-read in Data Network Stack & Connectivity

Missing Authentication for Critical Function in Data Modem

Buffer Copy Without Checking Size of Input in Automotive Platform

Buffer Over-read in Graphics

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in Audio

Use After Free in Video

Buffer Copy Without Checking Size of Input in Core Services

Out-of-bounds Write in Computer Vision

Use After Free in HLOS

Improper Input Validation in Video Analytics and Processing

Stack-based Buffer Overflow in Performance

Use After Free in GPS

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Use After Free in Automotive GPU

Use After Free in Computer Vision

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Integer Overflow or Wraparound in WLAN HOST

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer

Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer

Improper Input Validation in Core

Signed-to-unsigned conversion error in Audio

Improper Restrictions of Operations within the Bounds of a Memory Buffer in Linux

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to use after free in Modem while modem initialization

Memory corruption in WLAN due to use after free

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in Automotive Android OS due to improper input validation

Memory corruption in display due to double free while allocating frame buffer memory

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity,…

Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, Snapdragon Compute,…

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…

Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon…

Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity,…

Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT,…

Possible out of bound memory access due to improper boundary check while creating HSYNC fence in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…