Use After Free in DSP Service

Memory corruption while processing Codec2 during v13k decoder pitch synthesis

Use After Free in Graphics Linux

Buffer Over-read in Data Network Stack & Connectivity

Exposed Dangerous Method or Function in HLOS

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in Display

Incorrect Calculation of Buffer Size in HLOS

Out-of-bounds Write in Video

Buffer Copy Without Checking Size of Input in Video

Use After Free in GPS HLOS Driver

Out-of-bounds Write in SPS Applications

Use After Free in HLOS

Use After Free in NPU

NULL Pointer Dereference in Display

Stack-based Buffer Overflow in Performance

Use After Free in GPS

Use After Free in Automotive GPU

Use After Free in Graphics

Untrusted Pointer Dereference in DSP Service

Use After Free in Graphics Linux

Use After Free in Graphics Linux

Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive

Use After Free in Graphics

Integer Overflow or Wraparound in Graphics

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Video

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Buffer Copy Without Checking Size of Input in Camera Driver

Use After Free in HLOS

Buffer Over-read in Video

NULL Pointer Dereference in SPS-HLOS

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Information disclosure in WLAN HAL when reception status handler is called

Information disclosure in WLAN HAL while handling the WMI state info command

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request