Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Use After Free in DSP Service

Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Use After Free in DSP Services

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Integer Overflow or Wraparound in Display

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Buffer Over-read in Multi Mode Call Processor

Missing Authentication for Critical Function in Data Modem

Missing Authorization in Core

Buffer Over-read in Windows Compute

Out-of-bounds Write in HLOS

NULL Pointer Dereference in SPS Applications

Buffer Copy Without Checking Size of Input in Automotive Audio

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Use After Free in Secure Processor

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Audio

Use After Free in Video

Out-of-bounds Write in Windows Compute

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while encoding the image data

Memory corruption due to double free when multiple threads race to set the timestamp store

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption while performing private key encryption in trusted application

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption during the image encoding process