Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Out of Bounds write in Linux Camera

Use After Free in HLOS

Memory corruption while processing IOCTL command to handle buffers associated with a session

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in FW

Reachable Assertion in Modem

Reachable Assertion in BT Controller

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure when Video engine escape input data is less than expected minimum size

Buffer Over-read in WLAN Host Communication

Buffer Over-read in DSP Service

Information Exposure in Computer Vision

Transient DOS while processing IOCTL call for image encoding

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

There may be information disclosure during memory re-allocation in TZ Secure OS

Information disclosure while deriving keys for a session for any Widevine use case

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Information Disclosure while processing IOCTL request in FastRPC

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Information disclosure in WLAN HAL while handling command through WMI interfaces

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Information disclosure in IOE Firmware while handling WMI command

Information disclosure in DSP Services while loading dynamic module

Out-of-bounds Write in Camera Driver