Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Information disclosure while parsing sub-IE length during new IE generation

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Verification of Cryptographic Signature in Boot

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Information disclosure in Audio while accessing AVCS services from ADSP payload

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks

Use After Free in Camera Driver

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

Information disclosure in Core services while processing a Diag command

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Untrusted Pointer Dereference in Audio

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Use After Free in HLOS

Buffer Over-read in Hypervisor

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Use After Free in WLAN Host Communication

Buffer Over-read in Automotive Software platform based on QNX

Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks

Buffer Over-read in Automotive OS Platform

Buffer Over-read in Automotive Autonomy

Buffer Over-read in Automotive Autonomy