Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Information Disclosure while parsing beacon frame in STA

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption while processing command message in WLAN Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality

Memory corruption while handling IOCTL call from user-space to set latency level

Buffer Over-read in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Over-read in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Transient DOS while parsing the EPTM test control message to get the test pattern

Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS while parsing per STA profile in ML IE

Transient DOS may occur while parsing extended IE in beacon

Transient DOS may occur while processing the country IE

Information disclosure while parsing the OCI IE with invalid length

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Firmware

Transient DOS while processing TID-to-link mapping IE elements

Information disclosure while parsing sub-IE length during new IE generation

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS in WLAN Firmware while processing a FTMR frame

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware while parsing FT Information Elements

Transient DOS while parsing BTM ML IE when per STA profile is not included

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan