Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption due to improper validation of array index in Audio

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

Information disclosure in modem due to improper check of IP type while processing DNS server query

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes

Information disclosure in modem due to buffer over-red while performing checksum of packet received

Denial of service in modem due to missing null check while processing TCP or UDP packets from server

Denial of service in modem due to missing null check while processing IP packets with padding

Denial of service in modem due to null pointer dereference while processing DNS packets

Information disclosure in modem due to buffer over read in dns client due to missing length check

Information disclosure in modem due to buffer over-read while processing response from DNS server

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic issue while performing RSA PKCS padding decoding

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption during concurrent SSR execution due to race condition on the global maps list

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Information disclosure in Core services while processing a Diag command

Out-of-bounds Write in Camera Driver

Stack-based Buffer Overflow in Windows Compute

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request

Memory corruption may occur while processing the OIS packet parser

Memory corruption while processing I2C settings in Camera driver

Memory corruption while accessing MSM channel map and mixer functions

Use After Free in Camera Driver

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Over-read in Video

Information Exposure in Computer Vision