Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Information Exposure in DSP Services

Information exposure in DSP services due to improper handling of freeing memory

Incorrect Type Conversion in Video driver

Memory corruption in video driver due to type confusion error during video playback

Integer overflow to buffer overflow in Audio

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.

Use-After-Free Issue in Display

Memory corruption in display due to double free while allocating frame buffer memory

Incorrect type casting in Display driver

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Integer Overflow to Buffer Overflow in Bluetooth HOST

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Buffer Over-read in BOOT

Denial of service while processing fastboot flash command on mmc due to buffer over read

Buffer over-read in Bluetooth HOST

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.

Use of Out-of-range Pointer Offset in MODEM

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

Stack-based Buffer Overflow in WIN Product

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.

Buffer Copy without Checking the Size of Input in WLAN Firmware

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.

Improper Input Validation in Video Analytics and Processing

Memory corruption while processing API calls to NPU with invalid input.

Stack-based Buffer Overflow in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Integer Overflow or Wraparound in WLAN Host Communication

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

Buffer Over-read in MProc

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Use After Free in Video

Memory corruption when multiple threads try to unregister the CVP buffer at the same time.