Memory corruption while playing audio file having large-sized input buffer

Integer Overflow or Wraparound in Display

Use After Free in SCE-Mink

Out-of-bounds Write in Windows Compute

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption while sound model registration for voice activation with audio kernel driver

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption in display driver while detaching a device

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when size of buffer from previous call is used without validation or re-initialization

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS during music playback of ALAC content

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Transient DOS while processing the CU information from RNR IE

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure while capturing logs as eSE debug messages are logged

Information disclosure while processing IO control commands

Information disclosure during audio playback

Information disclosure while processing information on firmware image during core initialization

Buffer Over-read in Audio