Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer

Cryptographic issue in HLOS during key management

Memory Corruption in Core due to secure memory access by user while loading modem image

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption in Graphics while importing a file

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption due to double free in core while initializing the encryption key

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in Multi Mode Call Processor

Improper Authentication in Multi-Mode Call Processor

Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics

Transient DOS while decoding message of size that exceeds the available system memory

Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE

Transient DOS due to improper authorization in Modem

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Improper Validation of Syntactic Correctness of Input in Display

Missing Cryptographic Step in Data Modem

Cryptographic Issues in Core

Information disclosure in Audio while accessing AVCS services from ADSP payload

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Linux

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Use After Free in Video

Use of Out-of-range Pointer Offset in Camera Driver

Improper Validation of Array Index in Camera_Linux

Out of Bounds write in Linux Camera

Use After Free in HLOS

Buffer Copy Without Checking Size of Input in Audio

Use After Free in Data Network Stack & Connectivity

Out-of-bounds Write in Audio