Memory corruption while selecting the PLMN from SOR failed list

Memory corruption while decoding of OTA messages from T3448 IE

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Memory corruption occurs when a secure application is launched on a device with insufficient memory

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations

Memory corruption while passing pages to DSP with an unaligned starting address

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while allocating buffers in DSP service

Memory corruption while processing user buffers

Memory corruption while processing a malformed license file during reboot

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

Memory corruption while performing private key encryption in trusted application

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing manipulated payload in video firmware

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while processing API calls to NPU with invalid input

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption while processing GPU commands

Information disclosure while creating MQ channels

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS may occur while processing malformed length field in SSID IEs

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while performing sensor register read operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Memory corruption while handling sensor utility operations