Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Use After Free in Camera Driver

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Transient DOS while parsing BTM ML IE when per STA profile is not included

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Over-read in Video

Information disclosure while running video usecase having rogue firmware

Information disclosure while deriving keys for a session for any Widevine use case

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS in Core when DDR memory check is called while DDR is not initialized