Stack-based Buffer Overflow in WLAN Windows Host

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Stack-based Buffer Overflow in Performance

Use After Free in GPS

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Use After Free in Graphics Linux

Use After Free in Automotive GPU

Use After Free in Computer Vision

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input in WLAN Windows Host

Use After Free in ComputerVision

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Buffer Over-read in Display

Untrusted Pointer Dereference in Computer Vision

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption while processing IOCTL handler in FastRPC

Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when size of buffer from previous call is used without validation or re-initialization

Memory corruption in Kernel while handling GPU operations

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger

Memory corruption while reading ACPI config through the user mode app

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory Corruption in Core during syscall for Sectools Fuse comparison feature

Memory corruption while parsing the ADSP response command

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory Corruption while accessing metadata in Display

Memory corruption in Audio while validating and mapping metadata

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request

Memory Corruption due to improper validation of array index in Linux while updating adn record

Memory corruption due to improper validation of array index in Audio

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in Trusted Execution Environment while calling service API with invalid address

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Linux Networking due to double free while handling a hyp-assign

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal