Qualcomm ≫ Qcn7606 Firmware

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Memory corruption while handling payloads from remote ESL.

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.

Memory corruption in QESL while processing payload from external ESL device to firmware.

Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.

Memory corruption due to double free in Core while mapping HLOS address to the list.

Information disclosure in Kernel due to indirect branch misprediction.