Integer Overflow or Wraparound in GPS

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Buffer Copy Without Checking Size of Input in Automotive Platform

Use After Free in Automotive Audio

Out-of-bounds Write in HLOS

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption during GNSS HAL process initialization

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Information disclosure while creating MQ channels

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Improper Validation of Syntactic Correctness of Input in Display

Stack-based Buffer Overflow in Display

Cryptographic Issues in Core