Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

Buffer Over-read in Data Modem

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while running invalid audio recording from ADSP.

Buffer Copy Without Checking Size of Input in Video

Memory corruption while parsing qcp clip with invalid chunk data size.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption while invoking callback function of AFE from ADSP.

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

Reachable Assertion in Data Modem

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS handshake.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking