Memory corruption while processing IOCTL handler in FastRPC

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption when the payload received from firmware is not as per the expected protocol size

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux

Memory corruption while verifying the serialized header when the key pairs are generated

Memory corruption in HLOS while checking for the storage type

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in Core while processing RX intent request

Memory corruption in Audio while running invalid audio recording from ADSP

Memory corruption in HLOS while invoking IOCTL calls from user-space

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory Corruption in SPS Application while exporting public key in sorter TA

Improper Input Validation in Modem

Reachable Assertion in Modem

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS while parsing per STA profile in ML IE

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Transient DOS may occur while processing the country IE

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Firmware

Transient DOS while processing TID-to-link mapping IE elements

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS in Bluetooth Host while rfc slot allocation

Use After Free in Computer Vision

Stack-based Buffer Overflow in Display

Missing Cryptographic Step in Data Modem

Cryptographic issues while generating an asymmetric key pair for RKP use cases

Improper Input Validation in Trusted Execution Environment

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver