Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Use After Free in HLOS

Memory corruption while handling file descriptor during listener registration/de-registration.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Buffer Over-read in Multi Mode Call Processor

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while allocating the ion buffer during the music playback.