Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS while parsing per STA profile in ML IE

Transient DOS may occur while parsing extended IE in beacon

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Host Cmn

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS while parsing the received TID-to-link mapping action frame

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS while processing 11AZ RTT management action frame received through OTA

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in WLAN Firmware while processing a FTMR frame

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame

Stack-based Buffer Overflow in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic issues while generating an asymmetric key pair for RKP use cases

Improper Input Validation in Trusted Execution Environment

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Information disclosure in Core services while processing a Diag command

Out-of-bounds Write in Camera Driver

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Transient DOS while parsing BTM ML IE when per STA profile is not included

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Video

Information disclosure while deriving keys for a session for any Widevine use case

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus