Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Buffer Over-read in WLAN Host

Transient DOS while parsing ESP IE from beacon/probe response frame.

Integer Overflow or Wraparound in Automotive GPU

Memory corruption while allocating memory in HGSL driver.

Use of Uninitialized Variable in Automotive GPU

Memory corruption while processing IOCTL call to set metainfo.

Use After Free in Automotive Telematics

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Performance

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.

Buffer Copy Without Checking Size of Input in Graphics Linux

Memory corruption while processing GPU page table switch.

Integer Overflow to Buffer Overflow in Audio

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Use After Free in Automotive GPU

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Use After Free in Automotive Multimedia

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

Stack-based Buffer Overflow in Power Management IC

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.