Improper Validation of Array Index in Bluetooth HOST

Use After Free in BTHOST

Use After Free in NPU

Buffer Over-read in Camera

Use After Free in Camera

Use After Free in Display

Double Free in Display

Incorrect Calculation of Buffer Size in Video

Use After Free in Display

Use After Free in Bluetooth HOST

Buffer Over-read in Display

Improper Access Control in Camera Driver

Improper Access Control in Camera Driver

Out-of-bounds Write in Computer Vision

Use of Out-of-range Pointer Offset in Camera Driver

Use After Free in HLOS

Use After Free in HLOS

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Improper Validation of Array Index in Display

Buffer Over-read in Display

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

NULL Pointer Dereference in Display

Use After Free in MProc

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while validating number of devices in Camera kernel

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while processing GPU commands

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Memory corruption while taking snapshot when an offset variable is set by camera driver

Use After Free in Qualcomm IPC

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Over-read in Display

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Untrusted Pointer Dereference in Computer Vision

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events