Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Bluetooth Host while rfc slot allocation

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Stack-based Buffer Overflow in Display

Missing Cryptographic Step in Data Modem

Exposed Dangerous Method or Function in HLOS

Improper Input Validation in Trusted Execution Environment

Information disclosure in Audio while accessing AVCS services from ADSP payload

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Use After Free in DSP Service

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Out-of-bounds Read in Core

Out-of-bounds Read in Core

Improper Access Control for Register Interface in TZ Firmware

Transient DOS while parsing BTM ML IE when per STA profile is not included

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Buffer Over-read in Automotive OS Platform Android

Buffer Over-read in Video

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Core when DDR memory check is called while DDR is not initialized

While processing the authentication message in UE, improper authentication may lead to information disclosure