Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure during audio playback.
-
Medium 6.1
Buffer Over-read in Computer Vision
Information disclosure while processing information on firmware image during core initialization.
-
Medium 6.6
Improper Input Validation in Computer Vision
Memory corruption while processing frame packets.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
-
High 7.5
Buffer Over-read in Multi Mode Call Processor
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
-
Medium 5.5
Buffer Over-read in Automotive OS Platform
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
-
High 7.5
Buffer Over-read in WLAN Host Cmn
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
-
High 8.4
Integer Overflow to Buffer Overflow in Automotive OS Platform
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
-
High 7.8
Use After Free in DSP Services
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
-
High 7.8
Improper Validation of Array Index in DSP Services
Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.
-
High 7.8
Buffer Over-read in WLAN Windows Host
Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host
Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.
-
High 7.8
Buffer Over-read in WLAN Windows Host
Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space.
-
High 7.8
Stack-based Buffer Overflow in WLAN Windows Host
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host
Memory corruption when IOCTL call is invoked from user-space to read board data.
-
High 7.5
Permissions, Privileges, and Access Controls issue in Automotive OS Platform
Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.
-
Medium 6.1
Buffer Over-read in Automotive Autonomy
information disclosure while invoking the mailbox read API.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
-
Medium 6.8
Buffer Over-read in DSP Service
Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while processing frame command IOCTL calls.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Computer Vision
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
-
Medium 6.6
Buffer Over-read in Automotive Autonomy
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
-
High 8.4
Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity
Memory corruption while processing IPA statistics, when there are no active clients registered.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.
-
High 7.8
Improper Input Validation in Video Analytics and Processing
Memory corruption while processing API calls to NPU with invalid input.
-
High 7.8
Stack-based Buffer Overflow in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.
-
High 7.8
Stack-based Buffer Overflow in Performance
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
-
High 7.5
Integer Overflow or Wraparound in WLAN Host Communication
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
-
High 8.4
Buffer Over-read in MProc
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
-
Medium 6.7
Use After Free in Video
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
-
High 8.4
Improper Validation of Array Index in Hypervisor
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
-
Medium 6.7
Untrusted Pointer Dereference in Audio
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
-
Medium 6.1
Buffer Over-read in Neural Processing Unit
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Camera Driver
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
-
High 8.4
Buffer Over-read in IPA
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
-
High 7.8
Use After Free in Video
Crafted Binder Request Causes Heap UAF in MediaServer