Use After Free in Display

Buffer Over-read in Display

Improper Access Control in Camera Driver

Use After Free in GPS HLOS Driver

Improper Input Validation in HLOS

Improper Access Control in Hypervisor

Use of Out-of-range Pointer Offset in Camera Driver

Use After Free in Camera Driver

Use After Free in HLOS

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption while handling IOCTL call from user-space to set latency level

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing user packets to generate page faults

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver

Use After Free in Qualcomm IPC

Untrusted Pointer Dereference in Computer Vision

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption while processing IOCTL handler in FastRPC

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM