Use of Out-of-range Pointer Offset in Graphics

Improper Validation of Array Index in Multi-Mode Call Processor

Improper Input Validation in WLAN Resource Manager

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Data Modem

Buffer Copy without Checking Size of Input in Data Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network

Memory corruption due to improper validation of array index in Multi-mode call processor

Improper Authentication in GPS_GNSS

Buffer Copy Without Checking Size of Input in Modem

Improper Authentication in GPS HLOS Driver

Untrusted Pointer Dereference in TZ Firmware

Use of Out-of-range Pointer Offset in TZ Firmware

Buffer Copy Without Checking Size of Input in Hypervisor

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Buffer Over-read in Multi Mode Call Processor

Out-of-bounds Write in HLOS

Integer Overflow or Wraparound in Audio

Buffer Copy Without Checking Size of Input in Core Services

Out-of-bounds Write in Computer Vision

Use After Free in MProc

Use After Free in Computer Vision

Use After Free in DSP Services

Return of Stack Variable Address in Buses

Use After Free in Graphics Linux

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Use After Free in Graphics Linux

Configuration Issue in Core

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel

Use After Free in Linux Graphics

Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables

Integer Overflow or Wraparound in Radio Interface Layer

Integer Overflow or Wraparound in TZ Secure OS

Integer Overflow to Buffer Overflow in HLOS

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in core services when Diag handler receives a command to configure event listeners

Cryptographic issue in HLOS during key management

Memory corruption in TZ Secure OS while loading an app ELF

Memory corruption in DSP Service during a remote call from HLOS to DSP

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory corruption in Graphics while processing user packets for command submission

Memory Corruption in Core Platform while printing the response buffer in log

Memory corruption in Core Platform while printing the response buffer in log

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE

Memory Corruption in WLAN HOST while fetching TX status information