Qualcomm : Security Vulnerabilities, CVEs, CVSS score >= 9

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Memory corruption in video while parsing invalid mp2 clip.

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.

Memory corruption in Core while processing control functions.

Information disclosure in Modem while processing SIB5.

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Memory corruption in HLOS while running playready use-case.

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.

Memory corruption in core services when Diag handler receives a command to configure event listeners.

Memory corruption while handling payloads from remote ESL.

Memory corruption in QESL while processing payload from external ESL device to firmware.

A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source).

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

Memory corruption in Modem while processing security related configuration before AS Security Exchange.

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Memory Corruption in Core during syscall for Sectools Fuse comparison feature.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.