NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Buffer Copy Without Checking Size of Input in Video

Memory corruption while processing manipulated payload in video firmware.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing no-inherit IES.

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

Use of Out-of-range Pointer Offset in PCIe

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Use After Free in MProc

Memory corruption while processing command in Glink linux.

Use of Out-of-range Pointer Offset in Qualcomm IPC

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

Use After Free in WLAN Host Communication

Memory corruption while processing MBSSID beacon containing several subelement IE.

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI response message from firmware.

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Buffer over-read without Checking Size of Input in WLAN Host

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.

Integer Overflow or Wraparound in TZ Secure OS

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking