Where
-Infinity
0
Severity
7.8
Input Validation
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing API calls to NPU with invalid input.

First published (updated )
Severity
8.4
Integer Underflow
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4nat'

First published (updated )
Severity
9.8
Buffer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Certain unprivileged processes are able to perform IOCTL calls.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing voice packet with arbitrary data received from ADSP.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing GPU page table switch.

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESMIEI.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Audio during playback with speaker protection.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

First published (updated )
Severity
8.4
Incorrect Type Cast
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Graphics while importing a file.

First published (updated )
Severity
8.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.

First published (updated )
Severity
7.8
Buffer Overflow, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.

First published (updated )
Severity
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

First published (updated )
Severity
6.8
Out-of-bounds Read
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

First published (updated )
Severity
9.3
Double Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to double free in core while initializing the encryption key.

First published (updated )
Severity
8.4
Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

First published (updated )
Severity
7.8
Out-of-bounds Read
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

First published (updated )
Severity
8.4
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

First published (updated )
Severity
7.8
Buffer Overflow, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

First published (updated )
Severity
8.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in modem due to buffer overflow while processing a PPP packet

First published (updated )
Severity
7.8
Integer Overflow, Buffer Overflow
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

First published (updated )
Severity
4.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Denial of service while processing fastboot flash command on mmc due to buffer over read

First published (updated )
Severity
7.8
Buffer Overflow, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.

First published (updated )
Severity
8.4
Out-of-bounds Read
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

First published (updated )
Severity
8.4
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

First published (updated )
Severity
8.4
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203