Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

Memory corruption when keymaster operation imports a shared key.

Memory corruption when allocating and accessing an entry in an SMEM partition.

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.

Memory corruption while processing IPA statistics, when there are no active clients registered.

Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption while processing key blob passed by the user.

Memory corruption when the channel ID passed by user is not validated and further used.

Memory corruption in Core due to improper configuration in boot remapper.

Memory corruption while allocating memory for graphics.

Memory corruption when size of buffer from previous call is used without validation or re-initialization.

Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption while performing finish HMAC operation when context is freed by keymaster.