Buffer Over-read in WLAN Firmware

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

Reachable Assertion in Data Modem

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Buffer Over-read in Multi-Mode Call Processor

Memory corruption while decoding of OTA messages from T3448 IE.

Buffer Over-read in Multi-Mode Call Processor

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Integer Overflow or Wraparound in BT Controller

Transient DOS can occur while processing UCI command.

Improper Access Control in Core

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

Improper Input Validation in HLOS

Memory Corruption in HLOS while registering for key provisioning notify.

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.

Buffer Over-read in WLAN HOST

Information disclosure while parsing the OCI IE with invalid length.

Improper Validation of Array Index in Graphics_Linux

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.

Improper Validation of Array Index in Camera

Memory corruption while power-up or power-down sequence of the camera sensor.

Improper Validation of Array Index in Camera Driver

Memory corruption while validating number of devices in Camera kernel .