Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while allocating the ion buffer during the music playback.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

Improper Authentication in Core

Memory Corruption in Core due to secure memory access by user while loading modem image.

Improper Validation of Array Index in Automotive Autonomy

Memory corruption while operating the mailbox in Automotive.

Buffer Copy without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

Integer Overflow or Wraparound in HLOS

Memory corruption in HLOS while checking for the storage type.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

Integer Overflow or Wraparound in Bluetooth Host

Transient DOS in Bluetooth Host while rfc slot allocation.

Integer Overflow or Wraparound in Core Services

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

Use After Free in Computer Vision

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables