Transient DOS may occur while parsing SSID in action frames

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS may occur while processing the country IE

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in WLAN Firmware

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in Data Modem during DTLS handshake

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Stack-based Buffer Overflow in Display

Missing Cryptographic Step in Data Modem

Cryptographic issues while generating an asymmetric key pair for RKP use cases

Improper Input Validation in Trusted Execution Environment

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Out-of-bounds Write in Camera Driver

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Reachable Assertion in Modem

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while processing the CU information from RNR IE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Memory corruption while handling sensor utility operations