Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Memory corruption while selecting the PLMN from SOR failed list

Stack-based Buffer Overflow in WLAN Firmware

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in DSP Service

Use After Free in Automotive GPU

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while processing a malformed license file during reboot

Memory corruption while performing private key encryption in trusted application

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing manipulated payload in video firmware

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption may occur while validating ports and channels in Audio driver

Information disclosure while creating MQ channels

Buffer Over-read in WLAN Firmware

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN Firmware

Transient DOS may occur while processing malformed length field in SSID IEs

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Buffer Over-read in WLAN Firmware

Missing Authentication for Critical Function in HLOS

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing IOCTL command to handle buffers associated with a session

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Transient DOS when processing a received frame with an excessively large authentication information element

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

Information disclosure while running video usecase having rogue firmware

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus