Vendor
Qualcomm
3,001 known vulnerabilities.
Products
983 results · Clear filters · Feed
-
High 7.8
Integer Overflow or Wraparound in Core Services
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
-
High 8.4
Stack-based Buffer Overflow in WLAN HAL
Memory corruption while processing TPC target power table in FTM TPC.
-
High 7.3
Buffer Copy Without Checking Size of Input in Video
Memory corruption while parsing qcp clip with invalid chunk data size.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking HGSL IOCTL context create.
-
High 8.4
NULL Pointer Dereference in Windows Graphics
Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
-
High 8.4
Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory corruption while processing the IOCTL FM HCI WRITE request.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
-
High 7.5CVE-2023-33105 Public exploit
Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
-
High 7.5
Improper input Validation in Multi-Mode Call Processor
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing CAG info IE received from NW.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing IE fragments from server during DTLS handshake.
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while processing RT proxy port register driver.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parse fils IE with length equal to 1.
-
High 8.4
Improper Validation of Array Index in Display
Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
-
High 8.6
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
-
High 8.4
Untrusted Pointer Dereference in Display
Memory corruption while reading ACPI config through the user mode app.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing 11AZ RTT management action frame received through OTA.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
-
High 8.6
Stack-based Buffer Overflow in WLAN HOST
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
-
High 7.3
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
-
High 7.3
Untrusted Pointer Dereference in Video
Memory corruption in video while parsing invalid mp2 clip.
-
High 8.4
Improper Access Control in Automotive Multimedia
Memory corruption in Automotive Multimedia due to improper access control in HAB.
-
High 7.8
Use of out-of-range pointer offset in Video
Memory corruption when malformed message payload is received from firmware.
-
High 7.8
Use of Out-of-range Pointer Offset in PCIe
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
-
High 7.1
Buffer Over-read in Core
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
-
High 8.2
Buffer Copy Without Checking Size of Input in Modem
Information disclosure in Modem while processing SIB5.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
-
High 8.4
Use After Free in DSP Services
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
-
High 7.5
Buffer Over-read in Qualcomm ESL
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
-
High 7.5
Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
-
High 7.8
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
-
High 7.8
Use After Free in Automotive Audio
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
-
High 7.8
Use After Free in Audio
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.