Qualcomm ≫ Wcn3950 Firmware

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

Memory Corruption when retrieving output buffer with insufficient size validation.

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

Memory corruption while processing a frame request from user.

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

Memory corruption while using alignments for memory allocation.

Memory Corruption when adding user-supplied data without checking available buffer space.

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

Memory Corruption when accessing trusted execution environment without proper privilege check.