Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Improper Input Validation in Trusted Execution Environment

Cryptographic issue while parsing RSA keys in COBR format.

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Use of Out-of-range Pointer Offset in Qualcomm IPC

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

Signed-to-unsigned conversion error in Audio

Memory corruption while parsing the ADSP response command.

Stack-based Buffer Overflow in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Buffer Copy Without Checking Size of Input in Hypervisor

Memory corruption in Hypervisor when platform information mentioned is not aligned.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.