Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Multi Mode Call Processor

Permissions, Privileges, and Access Controls in Video Analytics and Processing

Out-of-bounds Write in Display

Incorrect Calculation of Buffer Size in HLOS

Buffer Copy Without Checking Size of Input in Computer Vision

Out-of-bounds Write in Video

Improper Access Control in Core

Use After Free in GPS HLOS Driver

Use After Free in NPU

NULL Pointer Dereference in Display

Improper Validation of Array Index in Camera

Improper Validation of Array Index in Camera

Use After Free in Computer Vision

Use After Free in Computer Vision

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Improper Input Validation in Video Analytics and Processing

Use After Free in GPS

Use After Free in Automotive GPU

Use After Free in ComputerVision

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption in Kernel while handling GPU operations

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Improper Input Validation in Modem

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host Communication

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage