Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame are not Properly validated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Buffer Over-read in WLAN Host

Transient DOS while parsing ESP IE from beacon/probe response frame.

Buffer Over-read in WLAN Host

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

Buffer Over-read in WLAN Host

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Integer Overflow or Wraparound in WLAN Host

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping action frame.

Improper Input Validation in WLAN Resource Manager

Memory corruption while redirecting log file to any file location with any file name.