Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Improper Restriction of Operations within the Bounds of a Memory Buffer in Hypervisor

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Multi Mode Call Processor

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Automotive Audio

Exposed Dangerous Method or Function in HLOS

Use of Uninitialized Variable in HLOS

Use After Free in Automotive Linux OS

Out-of-bounds Write in Windows Compute

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Use After Free in NPU

Use of Out-of-range Pointer Offset in Trust Management Engine

Use After Free in Automotive Android OS

Use of Out-of-range Pointer Offset in Automotive Audio

Use After Free in MProc

Untrusted Pointer Dereference in Automotive Android OS

Improper Input Validation in Hypervisor

Use After Free in DSP Services

Use After Free in GPS

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Use After Free in Qualcomm IPC

Integer Overflow or Wraparound in Automotive GPU

Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive

Integer Overflow or Wraparound in WLAN HOST

Use After Free in Audio

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS

Access of Uninitialized Pointer in SPS Applications

Integer Overflow or Wraparound in HLOS

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Use After Free in HLOS

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem

Memory corruption while invoking IOCTLs calls in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled

Memory corruption in Audio while processing the calibration data returned from ACDB loader

Memory corruption in Audio while processing IIR config data from AFE calibration block

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption in Core while processing RX intent request

Memory corruption in Audio while running invalid audio recording from ADSP

Memory corruption while sending SMS from AP firmware

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in Audio while invoking IOCTLs calls from the user-space