Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while processing IOCTL calls

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing camera use case IOCTL call

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while validating number of devices in Camera kernel

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Memory corruption while handling IOCTL call from user-space to set latency level

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice

Memory corruption while station LL statistic handling

Memory corruption while processing IOCTL calls to unmap the buffers

Memory corruption while processing user packets to generate page faults

Memory corruption while taking snapshot when an offset variable is set by camera driver

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Use After Free in Qualcomm IPC

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Buffer Over-read in Display

Untrusted Pointer Dereference in Computer Vision

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption while processing IOCTL handler in FastRPC

Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread