Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Stack based buffer overflow in Core

Memory corruption due to stack-based buffer overflow in Core

Buffer over-read in WLAN

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.

Buffer over-read in WLAN

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.

Use of Out-of-range Pointer Offset in MODEM

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

Use of Out-of-range Pointer Offset in Data Modem

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

Use After Free in Video

Crafted Binder Request Causes Heap UAF in MediaServer

Improper Access Control in Core.

QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.

Buffer Over-read in Multi Mode Call Processor

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

Double Free in HLOS

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Incorrect type conversion in WLAN

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

Improper authorization in Modem

Transient DOS due to improper authorization in Modem

Double free in Video

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Buffer over-read in WLAN Firmware.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Buffer copy without checking size of input in Audio.

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.