Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Memory corruption while performing sensor register read operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Integer Underflow (Wrap or Wraparound) in WLAN Host

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Memory corruption while handling sensor utility operations

Information disclosure while processing batch command execution in Video driver

Information disclosure when Video engine escape input data is less than expected minimum size

Buffer Over-read in WLAN Host Communication

Buffer Over-read in DSP Service

Transient DOS while processing IOCTL call for image encoding

Transient DOS can occur while processing UCI command

Information Disclosure while processing IOCTL request in FastRPC

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Out-of-bounds Write in Camera Driver