Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Reachable Assertion in FW

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while processing the CU information from RNR IE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Information disclosure when Video engine escape input data is less than expected minimum size

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Buffer Over-read in DSP Service

Transient DOS while processing IOCTL call for image encoding

Transient DOS while processing video packets received from video firmware

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Buffer Over-read in FM Host

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information disclosure in WLAN HAL while handling the WMI state info command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

While processing the authentication message in UE, improper authentication may lead to information disclosure