Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Memory corruption when decoding corrupted satellite data files with invalid signature offsets

Memory corruption in Hypervisor when platform information mentioned is not aligned

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Information disclosure may occur while processing goodbye RTCP packet from network

Missing Authentication for Critical Function in Data Modem

Use After Free in DSP Service

Use After Free in Graphics

Untrusted Pointer Dereference in Camera

Out-of-bounds Write in Video

Buffer Over-read in Windows Compute

NULL Pointer Dereference in SPS Applications

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations

Memory Corruption when retrieving output buffer with insufficient size validation

Memory corruption while preprocessing IOCTL request in JPEG driver

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption when processing IOCTLs for JPEG data without verification

Memory corruption while accessing a buffer during IOCTL processing

Memory corruption while invoking remote procedure IOCTL calls

memory corruption while processing an image encoding completion event

Memory corruption while encoding the image data

Memory corruption due to double free when multiple threads race to set the timestamp store

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption during the image encoding process

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing the TESTPATTERNCONFIG escape path

Memory corruption while processing a private escape command in an event trigger

Memory corruption while retrieving the CBOR data from TA

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Memory corruption while handling IOCTL call from user-space to set latency level