Qualcomm ≫ Qca0000 Firmware

Memory corruption when processing escape handling flow with insufficient user buffer sizes.

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Memory corruption while processing rear sensor IOCTL calls.

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

Memory Corruption when processing registry values with incorrect types using a direct query method.

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.