Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Core Services

Use After Free in Video

Use of Out-of-range Pointer Offset in Camera Driver

Improper Validation of Array Index in Camera_Linux

Out of Bounds write in Linux Camera

Use After Free in HLOS

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Use After Free in Computer Vision

Buffer Copy Without Checking Size of Input in Audio

Use After Free in Data Network Stack & Connectivity

Out-of-bounds Write in Audio

Use After Free in HLOS

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Integer Underflow (Wrap or Wraparound) in WLAN Host

Reachable Assertion in FW

Reachable Assertion in Modem

Buffer Over-read in Hypervisor

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Weak Authentication in HLOS

Buffer Over-read in Neural Processing Unit

Information Exposure in Computer Vision

NULL Pointer Dereference in SPS-HLOS

Information Exposure in TZ Secure OS

Improper Authorization in SPS-HLOS

Buffer Over-read in Audio

Buffer Over-read in Audio

Buffer Over-read in FM Host

NULL Pointer Dereference in HLOS

Buffer Over-read in TZ Secure OS

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Information disclosure in WLAN HAL while handling command through WMI interfaces

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Information disclosure in IOE Firmware while handling WMI command

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in DSP Services while loading dynamic module

Improper Authentication in Modem