Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCSLOADMODULE command.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption while running NPU, when NETWORKUNLOAD and (NETWORKUNLOAD or NETWORKEXECUTEV2) commands are submitted at the same time.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption due to improper access control in Qualcomm IPC.
Information disclosure while handling beacon or probe response frame in STA.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption when user provides data for FM HCI command control operations.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
Memory corruption while handling session errors from firmware.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while processing GPU page table switch.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
Transient DOS may occur while parsing extended IE in beacon.
Memory corruption in Graphics while processing user packets for command submission.
Memory corruption in Graphics while importing a file.
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Memory corruption while invoking callback function of AFE from ADSP.
Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables