In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check

In pktproc_fill_data_addr_without_bm of link_rx_pktproc.c, there is a possible out of bounds write due to a missing bounds check

In afe_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow

there is a possible out of bounds write due to a heap buffer overflow

A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues

In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check

In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation

In alac decoder, there is a possible information disclosure due to an incorrect bounds check

In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check

In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto

In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow

In RGXDestroyHWRTData of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception

In RGXDestroyZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception

In MMU_UnmapPages of mmu_common.c, there is a possible out of bounds read due to improper input validation

In DevmemIntChangeSparse of devicemem_server.c, there is a possible out of bounds write due to an integer overflow

In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check

In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow

In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntAcquireRemoteCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition

In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

In DevmemIntMapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free

In PMR_ReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free

In RGXUnbackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free

Remote code execution

Elevation of privilege

Elevation of privilege

Remote code execution

Remote code execution

there is a possible out of bounds write due to buffer overflow

In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check

In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check

In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow

In multiple locations, there is a possible code execution due to type confusion

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code

In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code

In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check

In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed

In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow

In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow

In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR

In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access

Product: AndroidVersions: Android SoCAndroid ID: A-273754094

In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed

In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check

In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check