Incorrect Calculation of Buffer Size in HLOS

Improper Input Validation in Video Analytics and Processing

Buffer Over-read in MProc

Double Free in HLOS

Use After Free in Kernel

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Buffer Copy Without Checking Size of Input in SPS Applications

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption due to double free in core while initializing the encryption key

Buffer Over-read in BT Controller

Buffer Over-read in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

NULL Pointer Dereference in HLOS

Information disclosure in IOE Firmware while handling WMI command

information disclosure due to cryptographic issue in Core during RPMB read request