Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

Use After Free in NPU

Memory corruption while calling the NPU driver APIs concurrently.

Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file.

Use After Free in GPS HLOS Driver

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Buffer Over-read in WLAN Host

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Double Free in SPS-HLOS

Memory corruption while retrieving the CBOR data from TA.

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption while performing private key encryption in trusted application.

Cryptographic Issues in Core

Cryptographic issue while performing RSA PKCS padding decoding.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

Out-of-bounds Write in Display

Memory corruption while processing a malformed license file during reboot.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory Corruption in SPS Application while exporting public key in sorter TA.

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

Buffer Over-read in Data HLOS - LNX

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Buffer Over-read in WLAN Embedded SW

Transient DOS may occur while processing malformed length field in SSID IEs.

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.