Use After Free in DSP Service

Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Memory corruption while selecting the PLMN from SOR failed list

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption during management frame processing due to mismatch in T2LM info element

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while playing audio file having large-sized input buffer

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory Corruption in Multi-mode Call Processor while processing bit mask API

Memory Corruption in Data Modem while making a MO call or MT VOLTE call

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Cryptographic issue occurs due to use of insecure connection method while downloading

Memory corruption while decoding of OTA messages from T3448 IE

Information Disclosure while parsing beacon frame in STA

Information disclosure in Modem while processing SIB5

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Cryptographic issue may occur while encrypting license data

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Buffer Over-read in Multi Mode Call Processor

Weak configuration in Automotive while VM is processing a listener request from TEE

Use After Free in DSP Service

Use After Free in Graphics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

NULL Pointer Dereference in HLOS

Out-of-bounds Write in HLOS

Stack-based Buffer Overflow in Camera Driver

Memory Corruption when adding user-supplied data without checking available buffer space

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption while calculating offset from partition start point

Memory corruption when calculating oversized partition sizes without proper checks