Information disclosure in Audio while accessing AVCS services from ADSP payload.

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Transient DOS in Audio when invoking callback function of ASM driver.

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Memory corruption when more scan frequency list or channels are sent from the user space.

Information disclosure while parsing sub-IE length during new IE generation.

Information Disclosure while parsing beacon frame in STA.

Information disclosure while handling SA query action frame.

INformation disclosure while handling Multi-link IE in beacon frame.

Information disclosure while handling beacon or probe response frame in STA.

Information disclosure while handling beacon probe frame during scan entry generation in client side.

Possible out of bound access in audio module due to lack of validation of user provided input.

Memory corruption in Audio during playback session with audio effects enabled.

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables