Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Core Services

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Out of Bounds write in Linux Camera

Memory corruption while handling buffer mapping operations in the cryptographic driver

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Integer Underflow (Wrap or Wraparound) in WLAN Host

Transient DOS when MAC configures config id greater than supported maximum value

Transient DOS when an LTE RLC packet with invalid TB is received by UE

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

There may be information disclosure during memory re-allocation in TZ Secure OS

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure during audio playback

Buffer Over-read in Audio

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Information disclosure in WLAN HAL while handling command through WMI interfaces

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Information disclosure in IOE Firmware while handling WMI command

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in DSP Services while loading dynamic module

While processing the authentication message in UE, improper authentication may lead to information disclosure