Information disclosure in Audio while accessing AVCS services from ADSP payload.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Information disclosure when VI calibration state set by ADSP is greater than MAXFBSPSTATE in the response payload to AFE calibration command.
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUGFS enabled.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
Information disclosure while parsing sub-IE length during new IE generation.
Information disclosure while handling beacon or probe response frame in STA.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Possible out of bound access in audio module due to lack of validation of user provided input.
Memory Corruption while accessing metadata in Display.
Memory corruption in Audio while validating and mapping metadata.
Memory corruption in Audio during playback session with audio effects enabled.
Information disclosure in Automotive multimedia due to buffer over-read.
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables