Memory corruption when decoding corrupted satellite data files with invalid signature offsets

Missing Authentication for Critical Function in Boot

Missing Authentication for Critical Function in Data Modem

Untrusted Pointer Dereference in Graphics

Use After Free in DSP Service

Use After Free in Graphics

Use After Free in Computer Vision

Use After Free in Computer Vision

NULL Pointer Dereference in HLOS

Memory corruption while processing a frame request from user

Memory Corruption when adding user-supplied data without checking available buffer space

Memory Corruption when accessing trusted execution environment without proper privilege check

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Buffer Over-read in WLAN HAL

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Buffer Over-read in WLAN HAL

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Missing Authentication for Critical Function in HLOS

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Integer Underflow (Wrap or Wraparound) in WLAN Host

Transient DOS when an LTE RLC packet with invalid TB is received by UE

Transient DOS when processing a received frame with an excessively large authentication information element