Integer Overflow or Wraparound in Graphics Linux

Use After Free in DSP Services

Improper Validation of Array Index in Multi-Mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API

Memory Corruption in Data Modem while making a MO call or MT VOLTE call

Cryptographic Issues in BT Controller

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Buffer Over-read in Multi Mode Call Processor

Out-of-bounds Write in Display

Incorrect Calculation of Buffer Size in HLOS

Buffer Copy Without Checking Size of Input in HLOS

Improper Access Control in Automotive Multimedia

Incorrect Calculation of Buffer Size in Video

Use After Free in GPS HLOS Driver

Use After Free in NPU

Improper Validation of Array Index in Audio

Buffer Over-read in MProc

Improper Validation of Array Index in Hypervisor

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Use After Free in DSP Service

Improper Access Control in Graphics Linux

Use After Free in Graphics

Double Free in HLOS

Use of Out-of-range Pointer Offset in Video

Use After Free in Kernel

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Buffer Copy Without Checking Size of Input in SPS Applications

Use of Out-of-range Pointer Offset in Audio

Improper Input Validation in Services

Use of Out-of-range Pointer Offset in PCIe

Buffer copy without checking size of Input in Core

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption while receiving a message in Bus Socket Transport Server

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption when processing cmd parameters while parsing vdev

Memory corruption in HLOS while invoking IOCTL calls from user-space

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory corruption in Audio while processing the VOC packet data from ADSP

Cryptographic issue in HLOS during key management

Memory corruption in TZ Secure OS while loading an app ELF