Memory corruption while processing IOCTL handler in FastRPC

Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when size of buffer from previous call is used without validation or re-initialization

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger

Memory corruption while reading ACPI config through the user mode app

Memory corruption in core services when Diag handler receives a command to configure event listeners

Buffer Over-read in WLAN Firmware

Transient DOS while processing received beacon frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Verification of Cryptographic Signature in Boot

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while processing simultaneous requests via escape path

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while parsing BTM ML IE when per STA profile is not included

Information disclosure while processing batch command execution in Video driver

Information disclosure when Video engine escape input data is less than expected minimum size

Buffer Over-read in DSP Service

Transient DOS while processing IOCTL call for image encoding

Information Disclosure while processing IOCTL request in FastRPC

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver