Improper Release of Memory Before Removing Last Reference in Graphics

Exposed Dangerous Method or Function in HLOS

Use After Free in Secure Processor

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in HLOS

Untrusted Pointer Dereference in Camera

Incorrect Authorization in Boot

Integer Overflow or Wraparound in Audio

Buffer Copy Without Checking Size of Input in Core Services

Out-of-bounds Write in Audio

Use After Free in Video

Memory corruption while performing encryption and decryption commands

Memory corruption while allocating buffers in DSP service

Memory corruption while processing user buffers

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while encoding the image data

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

Memory corruption due to double free when multiple threads race to set the timestamp store

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption while performing private key encryption in trusted application

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing an IOCTL command with an arbitrary address

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption during the image encoding process

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing manipulated payload in video firmware

Memory corruption while processing video packets received from video firmware

Memory corruption while processing a private escape command in an event trigger

Memory corruption while retrieving the CBOR data from TA

Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses

Memory corruption while operating the mailbox in Automotive

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while reading the FW response from the shared queue

Memory corruption during the FRS UDS generation process

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while reading secure file

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call