Use After Free in DSP Services

Buffer copy without checking the size of input in Core

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Copy Without Checking Size of Input in Computer Vision

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core

Use of Out-of-range Pointer Offset in Audio

Improper Validation of Array Index in Kernel

Integer Overflow to Buffer Overflow in HLOS

Integer Overflow to Buffer Overflow in User Identity Module

Buffer Copy Without Checking Size of Input in Boot

Use After Free in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Automotive Audio

Improper Input Validation in Core

Buffer Copy Without Checking Size of Input in Audio

Signed-to-unsigned conversion error in Audio

Use After Free in DSP Service

Improper validation of array index in WLAN HAL

Integer Overflow or Wraparound in Audio

Improper Access control in GPU Subsystem

Improper Input Validation in Audio

Improper Input Validation in WLAN HOST

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Improper access control in Kernel

Double free in Core

Stack-based buffer overflow in Modem

Use after free in Core

Incorrect Type Conversion or Cast in Graphics

Integer Overflow in Multimedia Framework

Integer overflow or wraparound in WLAN

Improper validation of array index in User Identity Module

Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT,…

Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…

Possible heap overflow due to lack of index validation before allocating and writing to heap buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…