Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Reachable Assertion in Modem

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

Return of Stack Variable Address in Buses

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items.

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Buffer Over-read in MProc

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Memory corruption when allocating and accessing an entry in an SMEM partition.

Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

Configuration weakness in modem

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

Memory Corruption in MODEM

Memory corruption in modem due to buffer overflow while processing a PPP packet