Integer Overflow or Wraparound in Display

Use After Free in SCE-Mink

Out-of-bounds Write in Windows Compute

Use After Free in NPU

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption while sound model registration for voice activation with audio kernel driver

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption in display driver while detaching a device

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when size of buffer from previous call is used without validation or re-initialization

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS during music playback of ALAC content

Memory corruption while parsing the memory map info in IOCTL calls