Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host

Transient DOS in WLAN Firmware while parsing a BTM request

Transient DOS in Data Modem during DTLS handshake

Transient DOS while parsing WPA IES, when it is passed with length more than expected size

Transient DOS in WLAN Firmware while processing a FTMR frame

Transient DOS when processing a NULL buffer while parsing WLAN vdev

Transient DOS in Bluetooth Host while rfc slot allocation

Information Disclosure in data Modem while parsing an FMTP line in an SDP message

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Buffer Over-read in WLAN Firmware

Allocation of Resources Without Limits or Throttling in OOBM

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Buffer Over-read in OOBM

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE

Reusing a Nonce, Key Pair in Encryption in HLOS

Missing Authentication for Critical Function in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain

Cryptographic issues while generating an asymmetric key pair for RKP use cases

Improper Input Validation in Trusted Execution Environment

Information disclosure in Audio while accessing AVCS services from ADSP payload

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while processing simultaneous requests via escape path

Memory corruption when using Virtual cdm (Camera Data Mover) to write registers

Memory corruption during concurrent SSR execution due to race condition on the global maps list

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host