Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger

Memory corruption while reading ACPI config through the user mode app

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory Corruption in Core during syscall for Sectools Fuse comparison feature

Memory corruption while parsing the ADSP response command

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS may occur while processing malformed length field in SSID IEs

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Buffer Over-read in Qualcomm IPC

Memory corruption while processing simultaneous requests via escape path

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…

Use After Free in Windows WLAN Host

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Memory corruption while processing IOCTL command to handle buffers associated with a session

Reachable Assertion in FW