Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing IE fragments from server during DTLS handshake

Improper Validation of Syntactic Correctness of Input in Display

Stack-based Buffer Overflow in Display

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Memory corruption while handling the PDR in driver for getting the remote heap maps

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while invoking IOCTL map buffer request from userspace

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in Audio

Buffer Over-read in Automotive OS Platform Android

Buffer Over-read in Video

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Core when DDR memory check is called while DDR is not initialized