Use After Free in DSP Services

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core

Use of Out-of-range Pointer Offset in Audio

Improper Validation of Array Index in Kernel

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer

Integer Overflow to Buffer Overflow in HLOS

Integer Overflow to Buffer Overflow in User Identity Module

Buffer Copy Without Checking Size of Input in Boot

Use After Free in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Automotive Audio

Improper Input Validation in Core

Buffer Copy Without Checking Size of Input in Audio

Use After Free in DSP Service

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload

Memory corruption due to improper validation of array index in Audio

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode

Memoru corruption in Audio when ADSP sends input during record use case

Memory corruption in WLAN HOST while receiving an WMI event from firmware

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment

Buffer over-read in WLAN Firmware

Buffer over-read in WLAN Firmware

Reachable Assertion in Data Modem

Reachable Assertion in Modem

Improper Input Validation in Modem

Reachable assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

NULL Pointer dereference in WLAN Firmware

Buffer over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer over-read in WLAN Firmware

Improper Authentication in Data Modem

Transient DOS in Audio while remapping channel buffer in media codec decoding

Transient DOS while parsing WLAN beacon or probe-response frame