Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs

Memory corruption while parsing the ML IE due to invalid frame content

Memory corruption while playing audio file having large-sized input buffer

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE

Memory corruption while processing MBSSID beacon containing several subelement IE

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Cryptographic issue occurs due to use of insecure connection method while downloading

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption while loading an ELF segment in TEE Kernel

Cryptographic issue may occur while encrypting license data

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Use After Free in DSP Service

Use After Free in Graphics

Missing Authorization in Core

Integer Overflow or Wraparound in Data Network Stack & Connectivity

NULL Pointer Dereference in HLOS

Out-of-bounds Write in HLOS

Stack-based Buffer Overflow in Camera Driver

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption while calculating offset from partition start point

Memory corruption when calculating oversized partition sizes without proper checks

Memory corruption when accessing resources in kernel driver

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while routing GPR packets between user and root when handling large data packet

Memory corruption while handling IOCTL calls to set mode

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption when triggering a subsystem crash with an out-of-range identifier

Memory corruption while processing client message during device management

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions

Memory corruption while processing request sent from GVM

Memory corruption while processing control commands in the virtual memory management interface

Memory corruption while handling repeated memory unmap requests from guest VM

Memory corruption while processing data sent by FE driver

Memory corruption while processing message in guest VM

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host

Memory corruption while copying the result to the transmission queue in EMAC

Memory corruption while retrieving the CBOR data from TA