Total
100
Critical
3
High
76
Medium
21
CISA KEV
2
Memory corruption while processing a GP command response.
Memory corruption during PlayReady APP usecase while processing TA commands.
Cryptographic issue while performing RSA PKCS padding decoding.
Memory corruption while handling client exceptions, allowing unauthorized channel access.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Memory corruption while handling file descriptor during listener registration/de-registration.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
An image with a version lower than the fuse version may potentially be booted lead to improper authentication.
Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.
Certain unprivileged processes are able to perform IOCTL calls.
Memory corruption while processing GPU page table switch.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Transient DOS in Audio when invoking callback function of ASM driver.
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Memory corruption in DSP Services during a remote call from HLOS to DSP.
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Memory Corruption in SPS Application while exporting public key in sorter TA.
Memory corruption in Audio while processing the VOC packet data from ADSP.
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Information disclosure in IOE Firmware while handling WMI command.
Memory corruption while invoking callback function of AFE from ADSP.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Memory corruption in Graphics while processing user packets for command submission.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
Memory Corruption in WLAN HOST while fetching TX status information.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Memoru corruption in Audio when ADSP sends input during record use case.
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
Transient DOS due to improper authorization in Modem
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
information disclosure due to cryptographic issue in Core during RPMB read request.
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Memory corruption in Graphics while importing a file.
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Memory corruption in WLAN due to use after free
Memory corruption in modem due to buffer overflow while processing a PPP packet
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
Information Disclosure in Graphics during GPU context switch.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Memory corruption due to stack-based buffer overflow in Core
Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
Information exposure in DSP services due to improper handling of freeing memory
Memory corruption in display due to double free while allocating frame buffer memory
Denial of service while processing fastboot flash command on mmc due to buffer over read
Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
