Double Free in Video

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Improper Validation of Array Index in Bluetooth HOST

Untrusted Pointer Dereference in DSP Service

Buffer Over-read in Camera

Improper Validation of Array Index in DSP Service

Memory corruption while processing packet data with exceedingly large packet

Memory corruption during the image encoding process

Memory corruption while processing command message in WLAN Host

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing the TESTPATTERNCONFIG escape path

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while executing timestamp video decode command with large input values

Memory corruption while processing a private escape command in an event trigger

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption may occur while processing device IO control call for session control

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset

Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address

Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Memory corruption while handling IOCTL call from user-space to set latency level

Improper Validation of Array Index in DSP Services

Buffer Over-read in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Over-read in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Buffer Over-read in Display

Memory corruption when keymaster operation imports a shared key