Incorrect Authorization in Graphics Windows

Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Cryptographic issue occurs due to use of insecure connection method while downloading

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information disclosure in Modem while processing SIB5

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Buffer Copy Without Checking Size of Input in Automotive Platform

Buffer Over-read in Graphics

Improper Release of Memory Before Removing Last Reference in Graphics

Use After Free in HLOS

Incorrect Authorization in Boot

Out-of-bounds Write in Audio

Release of Invalid Pointer or Reference in Android Core

Buffer Over-read in BT Controller

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Memory corruption when programming registers through virtual CDM

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption during the FRS UDS generation process

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while validating number of devices in Camera kernel

Memory corruption while processing frame packets

Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls

Use After Free in Computer Vision

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization