Stack-based Buffer Overflow in WLAN Firmware

Stack-based Buffer Overflow in OOBM

Out-of-bounds Read in OOBM

Use After Free in DSP_Services

Use After Free in DSP Service

Untrusted Pointer Dereference in Graphics

Integer Overflow or Wraparound in OOBM

Out-of-bounds Write in DSP Service

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Video

Out-of-bounds Write in Video

Untrusted Pointer Dereference in Windows Compute

Buffer Copy Without Checking Size of Input in Biometrics

Buffer Over-read in Windows Compute

Out-of-bounds Write in DSP Service

Out-of-bounds Read in DSP Service

NULL Pointer Dereference in HLOS

NULL Pointer Dereference in SPS Applications

Exposed dangerous function in windows host

Memory Corruption when handling power management requests with improperly sized input/output buffers

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations

Memory Corruption when retrieving output buffer with insufficient size validation

Memory corruption while preprocessing IOCTL request in JPEG driver

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation

Memory Corruption when processing invalid user address with nonstandard buffer address

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters

Memory Corruption when multiple threads concurrently access and modify shared resources

Memory corruption while processing a video session to set video parameters

Buffer Over-read in WLAN Firmware

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans

Buffer Over-read in WLAN Firmware

Allocation of Resources Without Limits or Throttling in OOBM

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Buffer Over-read in OOBM

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Verification of Cryptographic Signature in Boot

Missing Authentication for Critical Function in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain

Buffer Over-read in Qualcomm IPC