Qualcomm ≫ Wcn7850 Firmware

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.

Transient DOS in modem due to reachable assertion.

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.