Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Integer Overflow or Wraparound in Display

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Buffer Copy Without Checking Size of Input in Automotive Platform

Use After Free in Camera Driver

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent buffer access due to modification of the reference count

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while handling session errors from firmware

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption while sending SMS from AP firmware

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in Linux while sending DRM request

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory corruption due to use after free in Modem while modem initialization

Information disclosure while creating MQ channels

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Transient DOS in Modem after RRC Setup message is received

Transient DOS in Modem while triggering a camping on an 5G cell

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported