Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Memory corruption while selecting the PLMN from SOR failed list

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Stack-based Buffer Overflow in WLAN Firmware

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Buffer Over-read in Multi Mode Call Processor

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in DSP Service

Use After Free in Automotive GPU

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory corruption while processing a malformed license file during reboot

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing manipulated payload in video firmware

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption while validating number of devices in Camera kernel

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls

Use After Free in Computer Vision

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption while processing API calls to NPU with invalid input

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing IOCTL calls to unmap the buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when keymaster operation imports a shared key

Memory corruption while handling user packets during VBO bind operation

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size