Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Buffer Over-read in WLAN Firmware

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Improper Input Validation in Modem

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host Communication

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Missing Authentication for Critical Function in HLOS

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Use of Out-of-range Pointer Offset in ComputerVision

Use After Free in Computer Vision

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Reachable Assertion in BT Controller

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Use After Free in WLAN Host Communication

Reachable Assertion in Modem

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

NULL Pointer Dereference in SPS-HLOS

Information Exposure in TZ Secure OS

Transient DOS in Core when DDR memory check is called while DDR is not initialized