Missing Authorization in Core

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

Out of Bounds write in Linux Camera

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

Use After Free in NPU

Memory corruption while calling the NPU driver APIs concurrently.

Improper Input Validation in Automotive

Memory corruption while triggering commands in the PlayReady Trusted application.

Use After Free in GPS HLOS Driver

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Buffer Over-read in WLAN Host

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

Buffer Over-read in Data HLOS - LNX

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Integer Overflow or Wraparound in Audio

Memory corruption while routing GPR packets between user and root when handling large data packet.

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.