Transient DOS while processing CCCH data when NW sends data with invalid length.
Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
Possible buffer overflow due to Improper validation of received CF-ACK and CF-Poll data frames in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
Transient DOS due to improper input validation in WLAN Host.
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile
Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Transient DOS while processing CAG info IE received from NW.
Transient DOS in Modem after RRC Setup message is received.
Transient DOS while decoding message of size that exceeds the available system memory.
Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions.
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Transient DOS while parsing per STA profile in ML IE.
Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
Transient DOS may occur while parsing extended IE in beacon.
Transient DOS while processing received beacon frame.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS in WLAN Firmware while parsing rsn ies.
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Transient DOS may occur while processing malformed length field in SSID IEs.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
Transient DOS in Data modem while handling TLB control messages from the Network.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Transient DOS in Bluetooth Host while rfc slot allocation.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
Transient DOS while handling command data during power control processing.
Transient DOS in Audio while remapping channel buffer in media codec decoding.
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
Transient DOS while processing power control requests with invalid antenna or stream values.
Possible assertion due to improper validation of symbols configured for PDCCH monitoring in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity