In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free

In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free

In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free

In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow

In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the code

In wlan STA FW, there is a possible out of bounds write due to improper input validation

In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check

In store_upgrade and store_cmd of drivers/input/touchscreen/stm/ftm4_pdc.c, there are out of bound writes due to missing bounds checks or integer underflows

In prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect bounds check

In handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a missing bounds check

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination

In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow

In wlan firmware, there is a possible out of bounds write due to improper input validation

In wlan driver, there is a possible out of bounds write due to improper input validation

In wlan driver, there is a possible out of bounds write due to improper input validation

In venc, there is a possible out of bounds write due to a missing bounds check

In gnss service, there is a possible escalation of privilege due to improper certificate validation

In venc, there is a possible out of bounds write due to type confusion

In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow

There is a possible escalation of privilege due to improperly used crypto

In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check

In pktproc_fill_data_addr_without_bm of link_rx_pktproc.c, there is a possible out of bounds write due to a missing bounds check

In afe_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow

there is a possible out of bounds write due to a heap buffer overflow

A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues

In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check

In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation

In alac decoder, there is a possible information disclosure due to an incorrect bounds check

In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check

In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto

In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow

In RGXDestroyHWRTData of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception

In RGXDestroyZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception

In MMU_UnmapPages of mmu_common.c, there is a possible out of bounds read due to improper input validation

In DevmemIntChangeSparse of devicemem_server.c, there is a possible out of bounds write due to an integer overflow

In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check

In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntAcquireRemoteCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition

In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntMapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free

In PMR_ReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free

In RGXUnbackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

Remote code execution

Elevation of privilege

Elevation of privilege