Memory Corruption in Audio while allocating the ion buffer during the music playback

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Insufficient Granularity of Access Control in Core

Buffer Copy Without Checking Size of Input in WLAN Host

Buffer Over-read in WLAN HOST

Buffer Over-read in WLAN Host Cmn

Integer Overflow or Wraparound in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS while parsing the received TID-to-link mapping action frame

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Transient DOS while parsing ESP IE from beacon/probe response frame

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame