Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Improper Validation of Syntactic Correctness of Input in Display

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Out-of-bounds Write in Camera Driver

Use After Free in Camera Driver

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption while processing IOCTL command to handle buffers associated with a session

Reachable Assertion in BT Controller

Out-of-bounds Read in Core

Out-of-bounds Read in Core

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure while sending implicit broadcast containing APP launch information

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver