Integer Overflow or Wraparound in Graphics

Use After Free in SCE-Mink

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Buffer Over-read in Multi Mode Call Processor

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Buffer Over-read in Display

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption while processing audio effects

Information disclosure while creating MQ channels

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Buffer Over-read in Multi Mode Call Processor

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…