Improper Input Validation in WLAN Resource Manager

Memory corruption in WLAN Host while processing RRM beacon on the AP

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache

Stack-based Buffer Overflow in WLAN Firmware

Stack-based Buffer Overflow in WLAN Host

Memory corruption while loading an ELF segment in TEE Kernel

Buffer Over-read in WLAN Host Communication

Buffer Over-read in MProc

Return of Stack Variable Address in Buses

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of…

Memory corruption in Core while processing control functions

Memory corruption when processing cmd parameters while parsing vdev

Memory corruption in Kernel while parsing metadata

Memory Corruption in Core due to secure memory access by user while loading modem image

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Integer Overflow or Wraparound in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Integer Overflow or Wraparound in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Use After Free in WLAN Host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN HOST

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame

Transient DOS while parse fils IE with length equal to 1

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS while processing 11AZ RTT management action frame received through OTA