Memory corruption while selecting the PLMN from SOR failed list

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Information disclosure in Modem while processing SIB5

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Buffer Over-read in Multi Mode Call Processor

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Memory corruption while processing a malformed license file during reboot

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption in display driver while detaching a device

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls

Use After Free in Computer Vision

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing IOCTL calls to unmap the buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption in Kernel while handling GPU operations

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing received beacon frame

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16