Use After Free in DSP Service

Integer Overflow or Wraparound in Data Network Stack & Connectivity

NULL Pointer Dereference in HLOS

Buffer Copy Without Checking Size of Input in Automotive Audio

Stack-based Buffer Overflow in Camera Driver

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption while calculating offset from partition start point

Memory corruption when calculating oversized partition sizes without proper checks

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption when triggering a subsystem crash with an out-of-range identifier

Memory corruption while processing client message during device management

Stack-based Buffer Overflow in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Out-of-bounds Write in Camera Driver

Information disclosure while processing message from client with invalid payload

Out-of-bounds Write in Camera Driver