Use of Out-of-range Pointer Offset in WLAN HOST

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

Use After Free in Graphics Linux

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Use After Free in Graphics Linux

Memory corruption when the IOCTL call is interrupted by a signal.

Buffer Over-read in WLAN Host

Information disclosure while handling T2LM Action Frame in WLAN Host.

Stack-based Buffer Overflow in WLAN Windows Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Improper Authentication in GPS_GNSS

Cryptographic issue occurs due to use of insecure connection method while downloading.

Use After Free in Display

Memory corruption while processing a private escape command in an event trigger.

Use After Free in Display

Memory corruption while processing the TESTPATTERNCONFIG escape path.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing per STA profile in ML IE.

Double Free in Windows WLAN Host

Memory corruption while processing command message in WLAN Host.

Out-of-bounds Write in Video

Memory corruption while executing timestamp video decode command with large input values.

Buffer Copy Without Checking Size of Input in Computer Vision

Memory corruption while processing packet data with exceedingly large packet.

Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources.

Untrusted Pointer Dereference in Display

Memory corruption while reading ACPI config through the user mode app.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Improper Validation of Array Index in Display

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile