Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Buffer Over-read in Multi Mode Call Processor

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Exposed Dangerous Method or Function in HLOS

Use of Uninitialized Variable in HLOS

Use After Free in Automotive Linux OS

Out-of-bounds Write in Windows Compute

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Use After Free in NPU

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption may occur while accessing a variable during extended back to back tests

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while processing command in Glink linux

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace

Memory corruption while configuring a Hypervisor based input virtual device

Use After Free in DSP Services

Use After Free in Qualcomm IPC

Memory corruption while allocating memory in HGSL driver

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization

Memory corruption while verifying the serialized header when the key pairs are generated

Memory corruption in HLOS while checking for the storage type

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space

Memory corruption while copying the sound model data from user to kernel buffer during sound model register

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when multiple listeners are being registered with the same file descriptor

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem

Memory corruption while invoking IOCTLs calls in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled

Memory corruption in Audio while processing the calibration data returned from ACDB loader

Memory corruption in Audio while processing IIR config data from AFE calibration block

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption in Core while processing RX intent request

Memory corruption in Audio while running invalid audio recording from ADSP

Memory corruption while sending SMS from AP firmware

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in Audio while invoking callback function in driver from ADSP

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption while processing audio effects