Search vulnerabilities
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Improper Input Validation in Modem
Transient DOS in Modem after RRC Setup message is received.
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while playing audio file having large-sized input buffer.
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Use of Out-of-range Pointer Offset in Qualcomm IPC
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
Use After Free in Automotive Audio
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
Buffer Over-read in Hypervisor
Transient DOS during hypervisor virtual I/O operation in a virtual machine.
Improper Validation of Array Index in Automotive Autonomy
Memory corruption while operating the mailbox in Automotive.
Improper Authentication in Modem
While processing the authentication message in UE, improper authentication may lead to information disclosure.
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Reachable Assertion in Data Modem
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
Untrusted Pointer Dereference in Video
Memory corruption in video while parsing invalid mp2 clip.
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
Buffer Over-read in Trusted Execution Environment
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.