Use After Free in DSP Service

Use After Free in Graphics

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Buffer Over-read in Windows Compute

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in HLOS

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Stack-based Buffer Overflow in Camera Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Automotive

Improper Release of Memory Before Removing Last Reference in Graphics

Use After Free in Secure Processor

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Untrusted Pointer Dereference in Camera

Integer Overflow or Wraparound in Audio

Use After Free in Video

Use After Free in DSP Service

Integer Overflow or Wraparound in DSP Service

Use After Free in Camera

Buffer Over-read in BT Controller

Double Free in Video

Use After Free in Camera Driver

Improper Validation of Array Index in Bluetooth HOST

Use After Free in BTHOST

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption during the image encoding process

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing a private escape command in an event trigger

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur