Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware while parsing FT Information Elements

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Stack-based Buffer Overflow in Display

Missing Cryptographic Step in Data Modem

Improper Input Validation in Trusted Execution Environment

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Out-of-bounds Write in Camera Driver

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while processing IOCTL command to handle buffers associated with a session

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in Video

Buffer Over-read in Video

Information disclosure while deriving keys for a session for any Widevine use case

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

While processing the authentication message in UE, improper authentication may lead to information disclosure