Use After Free in DSP Service

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Missing Authentication for Critical Function in Data Modem

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while processing manipulated payload in video firmware

Memory corruption while reading the FW response from the shared queue

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while processing GPU page table switch

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Use After Free in Qualcomm IPC

Memory corruption during session sign renewal request calls in HLOS

Memory corruption while sending SMS from AP firmware

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Information disclosure while handling beacon or probe response frame in STA

Transient DOS while decoding message of size that exceeds the available system memory

Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions

Transient DOS in Modem after RRC Setup message is received

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Stack-based Buffer Overflow in Display