Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Use After Free in Video

Memory corruption during video playback when video session open fails with time out error.

Use After Free in Automotive Linux OS

Memory corruption while handling IOCTL calls to set mode.

Buffer Over-read in Video

Transient DOS while parsing video packets received from the video firmware.

Buffer Over-read in Video

Information disclosure while processing a firmware event.

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Information Exposure in Computer Vision

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Copy Without Checking Size of Input in Audio

Memory Corruption in Audio while invoking callback function in driver from ADSP.

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Improper Access Control in Graphics Linux

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Out-of-bounds Read in Core

Information disclosure while processing the hash segment in an MBN file.

Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

Buffer Over-read in WLAN Host Communication

Transient DOS while processing the EHT operation IE in the received beacon frame.

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music