Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while handling IOCTL call from user-space to set latency level

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while taking snapshot when an offset variable is set by camera driver

Use After Free in Qualcomm IPC

Memory corruption during session sign renewal request calls in HLOS

Memory corruption while processing IOCTL handler in FastRPC

Memory corruption when more scan frequency list or channels are sent from the user space

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address

Memory corruption while sending SMS from AP firmware

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption while parsing the ADSP response command

Memory Corruption while accessing metadata in Display

Memory corruption in Audio during playback session with audio effects enabled

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request

Memory Corruption due to improper validation of array index in Linux while updating adn record

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in RIL while trying to send apdu packet

Memory corruption in Trusted Execution Environment while calling service API with invalid address

Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client

Memory corruption in Video while calling APIs with different instance ID than the one received in initialization

Memory corruption in Linux while calling system configuration APIs

Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony

Memory corruption in Linux while sending DRM request

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory corruption in Automotive Android OS due to improper validation of array index