Memory corruption during the network scan request.
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
Memory corruption in WLAN due to use after free
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
Memory corruption due to use after free in trusted application environment.
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Memory corruption due to use after free in Modem while modem initialization.
Memory corruption in Linux android due to double free while calling unregister provider after register call.
Memory corruption in Audio due to incorrect type cast during audio use-cases.
Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
Memory corruption while handling sensor utility operations.
Memory corruption when more scan frequency list or channels are sent from the user space.
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption while processing the IOCTL FM HCI WRITE request.
Memory corruption while processing IOCTL handler in FastRPC.
Memory corruption in video while parsing invalid mp2 clip.
Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile, Snapdragon Wearables
Memory corruption in modem due to improper length check while copying into memory
Out of bound write and read in TA while processing command from NS side due to improper length check on command and response buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto
Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile
Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in Core due to improper configuration in boot remapper.
Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data received from firmware in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption while reading the FW response from the shared queue.
Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.
Memory corruption when programming registers through virtual CDM.
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption in Audio during playback with speaker protection.
Memory corruption while parsing the ADSP response command.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.