Use After Free in Graphics

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in HLOS

Exposed dangerous function in windows host

Use After Free in DSP Service

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Buffer Over-read in Camera

Stack-based Buffer Overflow in Camera Driver

Out-of-bounds Write in Computer Vision

Use After Free in Automotive Audio

Out-of-bounds Write in Automotive

Improper Release of Memory Before Removing Last Reference in Graphics

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Integer Overflow or Wraparound in Audio

Use After Free in Video

Use After Free in DSP Service

Integer Overflow or Wraparound in DSP Service

Out-of-bounds Write in Display

Release of Invalid Pointer or Reference in Android Core

Buffer Over-read in BT Controller

Memory corruption when programming registers through virtual CDM

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption while processing camera TPG write request

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption during the FRS UDS generation process

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation

Memory corruption while prociesing command buffer buffer in OPE module

Memory corruption Camera kernel when large number of devices are attached through userspace

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption due to improper bounds check while command handling in camera-kernel driver

Memory corruption while encoding JPEG format

Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session