Buffer over-read in WLAN Firmware

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.

Buffer Over-read in Core

Transient DOS in Core when DDR memory check is called while DDR is not initialized.

Buffer Copy Without Checking Size of Input in Modem

Information disclosure in Modem while processing SIB5.

NULL Pointer dereference in WLAN Firmware

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.

Buffer over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing t2lm buffers.

Buffer Copy Without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Reachable assertion in WLAN Firmware

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

Improper Input Validation in Core

Memory corruption in core services when Diag handler receives a command to configure event listeners.

Buffer Over-read in WLAN Host

Information Disclosure in WLAN Host when processing WMI event command.

Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Buffer Over-read in WLAN Host

Transient DOS while parsing ESP IE from beacon/probe response frame.

Buffer Over-read in WLAN Host

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

Integer Overflow or Wraparound in WLAN Host

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

Integer Overflow or Wraparound in Automotive GPU

Memory corruption while allocating memory in HGSL driver.

Use of Uninitialized Variable in Automotive GPU

Memory corruption while processing IOCTL call to set metainfo.

Buffer Over-read in WLAN HOST

Transient DOS while processing TID-to-link mapping IE elements.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping action frame.