Buffer Copy Without Checking Size of Input in HLOS

Memory corruption while performing private key encryption in trusted application.

Cryptographic Issues in Core

Cryptographic issue while performing RSA PKCS padding decoding.

Improper Validation of Array Index in Multi-Mode Call Processor

Memory corruption while selecting the PLMN from SOR failed list.

Out-of-bounds Write in Display

Memory corruption while processing a malformed license file during reboot.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory Corruption in SPS Application while exporting public key in sorter TA.

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Out-of-bounds Read in Core

Information disclosure while processing the hash segment in an MBN file.

Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Improper Access Control in Automotive Multimedia

Memory corruption while handling client exceptions, allowing unauthorized channel access.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.