Incorrect Authorization in Graphics

Use After Free in Graphics

Improper Authentication in GPS_GNSS

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Use After Free in SCE-Mink

Out-of-bounds Write in HLOS

Stack-based Buffer Overflow in Camera Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Improper Access Control for Register Interface in SCE-Mink

Out-of-bounds Write in Automotive

Improper Release of Memory Before Removing Last Reference in Graphics

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Out-of-bounds Write in Audio

Use After Free in DSP Service

Release of Invalid Pointer or Reference in Android Core

Buffer Over-read in BT Controller

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Buffer Copy Without Checking Size of Input in Computer Vision

Out-of-bounds Write in Camera_Linux

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during the FRS UDS generation process

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption while validating number of devices in Camera kernel

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing IOCTL calls to unmap the buffers

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Buffer Over-read in WLAN Firmware

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE

Transient DOS may occur while parsing SSID in action frames

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Buffer Over-read in Multi Mode Call Processor

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver