Use After Free in DSP Services

Memory corruption while processing IOCTL call for getting group info.

Use After Free in Computer Vision

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Buffer Over-read in WLAN Host Cmn

Memory corruption during management frame processing due to mismatch in T2LM info element.

Improper Validation of Array Index in Automotive Autonomy

Memory corruption while operating the mailbox in Automotive.

Buffer Copy Without Checking Size of Input in WLAN Host

Transient DOS may occur while processing the country IE.

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Improper Authentication in GPS_GNSS

Cryptographic issue occurs due to use of insecure connection method while downloading.

Buffer Over-read in WLAN Embedded SW

Transient DOS while processing received beacon frame.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing per STA profile in ML IE.

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while processing data packets in diag received from Unix clients.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Improper Access Control in Core

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

Improper Input Validation in HLOS

Memory Corruption in HLOS while registering for key provisioning notify.

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.