Use After Free in DSP Service

Use After Free in Graphics

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Buffer Over-read in Windows Compute

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in HLOS

Untrusted Pointer Dereference in Power Optimization Firmware

Untrusted Pointer Dereference in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in WinBlast Driver

Stack-based Buffer Overflow in Camera Driver

Buffer Copy Without Checking Size of Input in Automotive Platform

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Automotive

Improper Release of Memory Before Removing Last Reference in Graphics

Use After Free in Secure Processor

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Untrusted Pointer Dereference in Camera

Integer Overflow or Wraparound in Audio

Use After Free in Video

Memory corruption while allocating buffers in DSP service

Memory corruption while processing user buffers

Memory corruption while encoding the image data

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

Memory corruption due to double free when multiple threads race to set the timestamp store

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption during the image encoding process

Memory corruption while processing event close when client process terminates abruptly

Memory corruption while processing multiple simultaneous escape calls

Memory corruption while processing a private escape command in an event trigger

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur