Memory corruption while processing MBSSID beacon containing several subelement IE

Buffer Copy Without Checking Size of Input in Hypervisor

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Use After Free in Graphics

Improper Release of Memory Before Removing Last Reference in Graphics

Exposed Dangerous Method or Function in HLOS

Buffer Copy Without Checking Size of Input in Core Services

Buffer Copy Without Checking Size of Input in Video

Incorrect Calculation of Buffer Size in Video

Double Free in SPS-HLOS

Out-of-bounds Write in Computer Vision

Improper Input Validation in Automotive

Use After Free in NPU

NULL Pointer Dereference in Display

Improper Validation of Array Index in Audio

Use After Free in DSP Services

Use After Free in DSP Services

Use After Free in DSP Service

Return of Stack Variable Address in Buses

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption when the payload received from firmware is not as per the expected protocol size

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem

Memory corruption while invoking IOCTLs calls in Automotive Multimedia

Memory corruption while invoking HGSL IOCTL context create

Memory corruption in Audio while processing RT proxy port register driver

Memory corruption in Core Services while executing the command for removing a single event listener

Memory corruption in Graphics while processing user packets for command submission

Memory corruption in WLAN HAL while parsing WMI command parameters

Memory corruption in WLAN HAL while handling command through WMI interfaces

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message

Memory Corruption in WLAN HOST while parsing QMI response message from firmware

Memory Corruption in Audio while allocating the ion buffer during the music playback

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Firmware