Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when user provides data for FM HCI command control operations.

Buffer Over-read in WLAN HAL

Information disclosure in WLAN HAL while handling the WMI state info command.

Buffer Over-read in Data Modem

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

Use After Free in DSP Services

Memory corruption while processing IOCTL call for getting group info.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA.

Use After Free in Audio

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Use After Free in Kernel

Memory corruption when there is failed unmap operation in GPU.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

Reachable Assertion in Data Modem

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

Improper Authentication in Core

Memory Corruption in Core due to secure memory access by user while loading modem image.

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

Integer Overflow or Wraparound in TZ Secure OS

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS handshake.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection.

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables