Use After Free in Kernel

Integer Overflow to Buffer Overflow in Graphics Windows

Buffer copy without checking size of input (Classic buffer overflow) in HLOS

NULL Pointer Dereference in Windows Graphics

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Improper Validation of Array Index in Display

Untrusted Pointer Dereference in Display

Use of out-of-range pointer offset in Video

Buffer Copy Without Checking Size of Input in WLAN Host

Buffer Copy Without Checking Size of Input in WLAN Host

Use After Free in Audio

Use After Free in Camera

Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer

Use After Free in Audio

Improper Input Validation in Core

Signed-to-unsigned conversion error in Audio

Improper Access Control in Core

Improper Restrictions of Operations within the Bounds of a Memory Buffer in Display

Integer Overflow or Wraparound in Display

Improper Restriction of Operations within the Bounds of a Memory Buffer in Audio

Integer Overflow to Buffer Overflow in RIL

Improper Validation of Array Index in Linux

Improper Validation of Array Index in Audio

Buffer over-read in Modem

Multiple Dmabuf Kernel Address UAF Vulnerability

Multiple Type Confusion Vulnerability

Improper Validation of Array Index in GPS HLOS Driver

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN

Incorrect Type Conversion or Cast in Trusted Execution Environment

Use After Free in Audio

Permissions, Privileges, and Access Controls in Display

Buffer Copy Without Checking Size of Input in Linux

Incorrect Type Conversion or Cast in Video

Improper Restrictions of Operations within the Bounds of a Memory Buffer in Linux

Buffer Copy without Checking Size of Input in Data Network Stack & Connectivity

Double free in Linux Networking

Improper restriction of operations within the bounds of memory buffer in Linux

Use after free in Core

Double free in Linux-Android

Buffer copy without checking the size of input in Core

Buffer copy without checking the size of input in Core

Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size

Memory corruption in WLAN due to use after free

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg

Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id

Memory corruption due to use after free in trusted application environment