Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

memory corruption when WiFi display APIs are invoked with large random inputs

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario