Use After Free in Video

Out-of-bounds Write in WinBlast Driver

Use After Free in DSP Service

Integer Overflow or Wraparound in DSP Service

Buffer Copy Without Checking Size of Input in Camera

Use After Free in Camera

Buffer Over-read in BT Controller

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Improper Validation of Array Index in Bluetooth HOST

Use After Free in BTHOST

Out-of-bounds Write in Camera_Linux

Use After Free in NPU

Buffer Over-read in Camera

Use After Free in Camera

Use After Free in Display

Double Free in Display

Use After Free in Display

Use After Free in Bluetooth HOST

Buffer Over-read in Display

Improper Access Control in Camera Driver

Improper Access Control in Camera Driver

Out-of-bounds Write in Computer Vision

Detection of Error Condition Without Action in Hypervisor

Use of Out-of-range Pointer Offset in Camera Driver

Use After Free in HLOS

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Out-of-bounds Read in Windows WLAN Host

Improper Validation of Array Index in Display

Buffer Over-read in Display

Use of Out-of-range Pointer Offset in Trust Management Engine

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Use After Free in HLOS

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption while validating number of devices in Camera kernel

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice