Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Stack-based Buffer Overflow in WLAN Firmware

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in DSP Service

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive Audio

Use After Free in Automotive Audio

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while processing API calls to NPU with invalid input

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing IOCTL calls to unmap the buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption when keymaster operation imports a shared key

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Information disclosure while creating MQ channels

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA