Out-of-bounds Write in Camera Driver

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while parsing clock configuration data for a specific hardware type

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing IOCTL command to handle buffers associated with a session

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure while sending implicit broadcast containing APP launch information

Transient DOS in Core when DDR memory check is called while DDR is not initialized