Use of Uninitialized Variable in HLOS

Use After Free in Automotive Linux OS

Buffer Copy Without Checking Size of Input in Core Services

Integer Overflow or Wraparound in Automotive Platform

Stack-based Buffer Overflow in Automotive Software platform based on QNX

Out-of-bounds Write in Windows Compute

Stack-based Buffer Overflow in Automotive Software platform based on QNX

Release of Invalid Pointer or Reference in Android Core

Improper Input Validation in Automotive Software platform based on QNX

Use After Free in Camera Driver

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Use After Free in BTHOST

Use After Free in NPU

Out-of-bounds Write in Computer Vision

Improper Input Validation in Automotive Software platform based on QNX

Use After Free in GPS HLOS Driver

Out-of-bounds Write in Audio

Use of Out-of-range Pointer Offset in Camera Driver

Use After Free in HLOS

Use After Free in HLOS

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Automotive Vehicle Networks

Use After Free in Automotive Linux OS

Improper Access Control in Automotive Linux OS

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Improper Input Validation in Automotive OS Platform

NULL Pointer Dereference in Display

Use After Free in Automotive Android OS

Use After Free in Audio

Use of Out-of-range Pointer Offset in Automotive Audio

Use After Free in MProc

Untrusted Pointer Dereference in Automotive Android OS

Integer Overflow to Buffer Overflow in Automotive OS Platform

Use After Free in DSP Services

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Use After Free in GPS

Use After Free in Graphics Linux

Use After Free in Graphics

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption while handling user packets during VBO bind operation

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption while verifying the serialized header when the key pairs are generated