Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Transient DOS in Audio when invoking callback function of ASM driver.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Information disclosure when VI calibration state set by ADSP is greater than MAXFBSPSTATE in the response payload to AFE calibration command.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Information disclosure while handling beacon or probe response frame in STA.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Possible out of bound access in audio module due to lack of validation of user provided input.
Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory Corruption while accessing metadata in Display.
Memory corruption in Audio during playback session with audio effects enabled.
Information disclosure in Automotive multimedia due to buffer over-read.
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables