Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Buffer Over-read in Multi Mode Call Processor

Untrusted Pointer Dereference in Camera

Memory corruption while processing a malformed license file during reboot

Memory corruption during the image encoding process

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing a private escape command in an event trigger

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption while processing IOCTL handler in FastRPC

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while receiving a message in Bus Socket Transport Server

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory corruption occurs while processing command received from HLOS due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper validation of FTM command payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible buffer over read occurs due to lack of length check of request buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Transient DOS while processing received beacon frame

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS in Data Modem during DTLS handshake

Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption while processing simultaneous requests via escape path

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in…