Improper Validation of Array Index in Multi-Mode Call Processor

Memory corruption while decoding of OTA messages from T3448 IE

Buffer Over-read in Data Network Stack & Connectivity

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Out-of-bounds Write in HLOS

Incorrect Authorization in Boot

Use After Free in DSP Service

Integer Overflow or Wraparound in DSP Service

Out-of-bounds Write in Display

Buffer Over-read in BT Controller

Buffer Copy Without Checking Size of Input in HLOS

Buffer Copy Without Checking Size of Input in Computer Vision

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while processing manipulated payload in video firmware

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while processing API calls to NPU with invalid input

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption while processing GPU commands

Information disclosure while creating MQ channels

Buffer Over-read in WLAN HAL

Transient DOS may occur while processing malformed length field in SSID IEs

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Use After Free in Camera Driver

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver