Use After Free in DSP Service

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Stack-based Buffer Overflow in WLAN Firmware

Buffer Over-read in Multi-Mode Call Processor

Cryptographic Issues in BT Controller

Information Disclosure while parsing beacon frame in STA

Information disclosure in Modem while processing SIB5

Integer Overflow or Wraparound in GPS

Buffer Over-read in WLAN Host Communication

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Use After Free in Automotive Audio

Out-of-bounds Write in HLOS

Improper Access Control in Automotive Multimedia

Use After Free in NPU

Buffer Copy Without Checking Size of Input in Core Services

Buffer Copy Without Checking Size of Input in Video

Cryptographic Issues in Automotive

Improper Validation of Array Index in Automotive Autonomy

Detection of Error Condition Without Action in Hypervisor

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Out-of-bounds Write in Audio

Use After Free in HLOS

Use After Free in HLOS

Use of Out-of-range Pointer Offset in Trust Management Engine

Use After Free in GPS

Use After Free in Automotive GPU

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Untrusted Pointer Dereference in DSP Service

Use After Free in Qualcomm IPC

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread

Memory corruption while copying the sound model data from user to kernel buffer during sound model register

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when multiple listeners are being registered with the same file descriptor

Memory corruption in Kernel while handling GPU operations

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Buffer Over-read in WLAN Host

Buffer Over-read in Multi-Mode Call Processor

Insufficient Granularity of Access Control in Core

Buffer Over-read in Multi Mode Call Processor

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero