Use After Free in HLOS

Memory corruption during concurrent access to server info object due to unprotected critical field.

Buffer Over-read in WLAN Host Cmn

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Return of Stack Variable Address in Buses

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Data HLOS - QX

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Improper Access Control in Automotive Multimedia

Memory corruption in Automotive Multimedia due to improper access control in HAB.

Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile

Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto

Use of Out-of-range Pointer Offset in Camera Driver

Memory corruption may occur during IO configuration processing when the IO port count is invalid.