Integer Overflow to Buffer Overflow in User Identity Module

Memory corruption while using the UIM diag command to get the operators name.

Use of Out-of-range Pointer Offset in PCIe

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Reachable Assertion in Modem

Transient DOS in Modem while triggering a camping on an 5G cell.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux

Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Improper Authentication in Core

Memory Corruption in Core due to secure memory access by user while loading modem image.

Reachable Assertion in Multi-Mode Call Processor

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.

Improper Input Validation in Modem

Transient DOS in Modem after RRC Setup message is received.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS handshake.

Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking