Qualcomm ≫ Flight Rb5 5g Firmware

Memory corruption while retrieving the CBOR data from TA.

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Memory corruption while reading the FW response from the shared queue.

Transient DOS while parsing per STA profile in ML IE.

Memory corruption while triggering commands in the PlayReady Trusted application.

Memory corruption while calling the NPU driver APIs concurrently.

Memory corruption in display driver while detaching a device.

Memory corruption may occur while validating ports and channels in Audio driver.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.