Integer Overflow or Wraparound in Graphics

Use After Free in Graphics

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Information disclosure in Modem while processing SIB5

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Use After Free in DSP Service

Memory Corruption when accessing trusted execution environment without proper privilege check

Memory corruption occurs when a secure application is launched on a device with insufficient memory

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations

Memory corruption while passing pages to DSP with an unaligned starting address

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while allocating buffers in DSP service

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption during GNSS HAL process initialization

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption while handling user packets during VBO bind operation

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Information disclosure while creating MQ channels

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing an ANQP message

Transient DOS during music playback of ALAC content

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Missing Authentication for Critical Function in HLOS

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

Information disclosure while sending implicit broadcast containing APP launch information

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Information disclosure in WLAN HAL when reception status handler is called

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver