Improper input Validation in Multi-Mode Call Processor

Transient DOS while processing PDU Release command with a parameter PDU ID out of range.

Use After Free in Automotive Audio

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

Buffer Over-read in WLAN Firmware

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption while invoking callback function of AFE from ADSP.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while running invalid audio recording from ADSP.

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Buffer Over-read in Audio

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing per STA profile in ML IE.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Buffer over-read without Checking Size of Input in WLAN Host

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.

Integer Overflow or Wraparound in TZ Secure OS

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Improper Input Validation in Services

Information disclosure in Core services while processing a Diag command.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS handshake.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection.