Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Improper Input Validation in Trusted Execution Environment

Cryptographic issue while parsing RSA keys in COBR format.

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables

Memory corruption in wearables while processing data from AON.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Use after free in Neural Processing Unit

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core

Memory corruption in Core while processing RX intent request.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Buffer Over-read in WLAN Firmware

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

Integer Overflow or Wraparound in Core Services

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.