Use of Out-of-range Pointer Offset in Qualcomm IPC

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

Use of Out-of-range Pointer Offset in PCIe

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Use After Free in DSP Services

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.

Improper Input Validation in Modem

Transient DOS in Modem after RRC Setup message is received.

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_Linux

Memory corruption while processing camera TPG write request.

Double Free in Windows WLAN Host

Memory corruption while processing command message in WLAN Host.

Out-of-bounds Write in Video

Memory corruption while executing timestamp video decode command with large input values.

Buffer Copy Without Checking Size of Input in Computer Vision

Memory corruption while processing packet data with exceedingly large packet.

Use After Free in Camera Linux

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Use After Free in Automotive Multimedia

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Untrusted Pointer Dereference in Display

Memory corruption while reading ACPI config through the user mode app.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Buffer over-read without Checking Size of Input in WLAN Host

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.

Improper Validation of Array Index in Display

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Improper Input Validation in Services

Information disclosure in Core services while processing a Diag command.