Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Double Free in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Use of Out-of-range Pointer Offset in WLAN Windows Host

Use After Free in Windows WLAN Host

Buffer Over-read in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Over-read in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input in WLAN Windows Host

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Copy Without Checking Size of Input in WLAN Host

Buffer Over-read in WLAN HOST

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Firmware

Transient DOS while processing TID-to-link mapping IE elements

Information disclosure while parsing sub-IE length during new IE generation

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS in WLAN Firmware while processing a FTMR frame

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware while parsing FT Information Elements