Transient DOS while parsing WPA IES, when it is passed with length more than expected size

Transient DOS in WLAN Firmware while processing a FTMR frame

Transient DOS when processing a NULL buffer while parsing WLAN vdev

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS in WLAN Firmware while parsing no-inherit IES

Transient DOS in WLAN Firmware while parsing rsn ies

Transient DOS in WLAN Firmware while parsing a NAN management frame

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in WLAN Firmware while processing frames with missing header fields

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Exposed Dangerous Method or Function in HLOS

Improper Input Validation in Trusted Execution Environment

Information disclosure in Audio while accessing AVCS services from ADSP payload

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Information disclosure in Core services while processing a Diag command

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Use After Free in DSP Service

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Use After Free in HLOS

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Buffer Over-read in Hypervisor

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Weak Authentication in HLOS

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Core Services

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

NULL Pointer Dereference in SPS-HLOS

Information Exposure in TZ Secure OS

Improper Authorization in SPS-HLOS

Buffer Over-read in Automotive OS Platform