Integer Overflow to Buffer Overflow in User Identity Module

Memory corruption while using the UIM diag command to get the operators name.

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

Buffer Over-read in Audio

Transient DOS in Audio when invoking callback function of ASM driver.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Improper Authentication in GPS HLOS Driver

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Buffer Over-read in Audio

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Buffer over-read in WLAN Firmware

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Improper Input Validation in Modem

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

Use After Free in DSP Service

Memory corruption when two threads try to map and unmap a single node simultaneously.

Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Buffer Over-read in Audio

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Improper Validation of Array Index in HLOS

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Double Free in Data Network Stack & Connectivity

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking