Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Memory corruption while processing camera TPG write request

Memory corruption while operating the mailbox in Automotive

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption can occur in the camera when an invalid CID is used

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption while handling session errors from firmware

Untrusted Pointer Dereference in Computer Vision

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Information disclosure while creating MQ channels

Transient DOS while handling beacon frames with invalid IE header length

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS in WLAN firmware while parsing MLO (multi-link operation)

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

Information disclosure in modem due to improper check of IP type while processing DNS server query

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes

Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state

Information disclosure in modem due to buffer over-red while performing checksum of packet received

Denial of service in modem due to missing null check while processing TCP or UDP packets from server

Denial of service in modem due to missing null check while processing IP packets with padding

Denial of service in modem due to null pointer dereference while processing DNS packets

Information disclosure in modem due to buffer over read in dns client due to missing length check

Information disclosure in modem due to buffer over-read while processing response from DNS server

Cryptographic issue while performing RSA PKCS padding decoding

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation