Improper Validation of Array Index in HLOS

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.

Buffer Over-read in Data Modem

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

Buffer Over-read in Data Modem

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items.

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core

Memory corruption in Core while processing RX intent request.

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables

Memory corruption in wearables while processing data from AON.

Improper Authentication in GPS HLOS Driver

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Double Free in Windows WLAN Host

Memory corruption while processing command message in WLAN Host.

Out-of-bounds Write in Video

Memory corruption while executing timestamp video decode command with large input values.

Buffer Copy Without Checking Size of Input in Computer Vision

Memory corruption while processing packet data with exceedingly large packet.

Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources.

Untrusted Pointer Dereference in Display

Memory corruption while reading ACPI config through the user mode app.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Improper Validation of Array Index in Display

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile