Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in Modem

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while parsing BTM ML IE when per STA profile is not included

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure while opening a fastrpc session when domain is not sanitized

Buffer Over-read in Video

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Core when DDR memory check is called while DDR is not initialized

While processing the authentication message in UE, improper authentication may lead to information disclosure