Memory corruption while redirecting log file to any file location with any file name

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Stack-based Buffer Overflow in WLAN Firmware

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information disclosure in Modem while processing SIB5

Integer Overflow or Wraparound in GPS

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Improper Access Control in Automotive Multimedia

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while processing GPU page table switch

Memory corruption while handling session errors from firmware

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Information disclosure while creating MQ channels

Transient DOS while parsing probe response and assoc response frame

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Stack-based Buffer Overflow in Display

Cryptographic Issues in Core

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Information disclosure in Core services while processing a Diag command

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Buffer Over-read in Video

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

Information Exposure in Computer Vision

Transient DOS in Core when DDR memory check is called while DDR is not initialized