Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when size of buffer from previous call is used without validation or re-initialization

Memory corruption in Kernel while handling GPU operations

Memory corruption while allocating memory for graphics

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render

Memory corruption while processing the IOCTL FM HCI WRITE request

Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger

Memory corruption while reading ACPI config through the user mode app

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Buffer Over-read in WLAN Firmware

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Multi-Mode Call Processor

Buffer Copy Without Checking Size of Input in WLAN Host

Buffer Over-read in Multi Mode Call Processor

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification

Transient DOS while processing CAG info IE received from NW

Transient DOS while processing IE fragments from server during DTLS handshake

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Allocation of Resources Without Limits or Throttling in OOBM

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Buffer Over-read in OOBM

Use After Free in Computer Vision

Improper Verification of Cryptographic Signature in Boot

Buffer Over-read in Computer Vision

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation