Incorrect Authorization in Graphics

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Use After Free in DSP Service

Use After Free in Computer Vision

Use After Free in Computer Vision

Exposed dangerous function in windows host

Stack-based Buffer Overflow in Camera Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Improper Access Control for Register Interface in SCE-Mink

Out-of-bounds Write in Automotive

Improper Release of Memory Before Removing Last Reference in Graphics

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Integer Overflow or Wraparound in Audio

Memory corruption while allocating buffers in DSP service

Memory corruption while processing user buffers

Memory corruption while handling invalid inputs in application info setup

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during the FRS UDS generation process

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while validating number of devices in Camera kernel

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU commands

Memory corruption while handling session errors from firmware

Buffer Over-read in WLAN Firmware

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS may occur while parsing SSID in action frames

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Use After Free in Computer Vision

Reusing a Nonce, Key Pair in Encryption in HLOS

Buffer Over-read in Computer Vision