Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware

Transient DOS while processing TID-to-link mapping IE elements

Information disclosure in Video while parsing mp2 clip with invalid section length

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Bluetooth Host while rfc slot allocation

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Exposed Dangerous Method or Function in HLOS

Improper Input Validation in Trusted Execution Environment

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Use After Free in Camera Driver

Use After Free in DSP Service

Use of Out-of-range Pointer Offset in ComputerVision

Out-of-bounds Read in Core

Out-of-bounds Read in Core

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Use After Free in WLAN Host Communication

Reachable Assertion in Modem

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Over-read in Video

Buffer Over-read in Video

Improper Authorization in SPS-HLOS

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS in Core when DDR memory check is called while DDR is not initialized