Where
-Infinity
0
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

First published (updated )
Severity
6.7
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when processing registry values with incorrect types using a direct query method.

First published (updated )
Severity
6.5
Integer Underflow
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

First published (updated )
Severity
6.5
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

First published (updated )
Severity
8.1
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

First published (updated )
Severity
8.8
Buffer Overflow
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Memory corruption while using Strongbox due to buffer overflow.

First published (updated )
Severity
8.8
Out-of-bounds Read
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Memory corruption while using Strongbox due to missing bounds check.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when processing device identifier strings that exceed the expected maximum length.

First published (updated )
Severity
7.8
Null Pointer Dereference
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.

First published (updated )
Severity
6.7
Input Validation
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Memory corruption in diagnostic services due to absence of input validation

First published (updated )
Severity
6.4
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

First published (updated )
Severity
7.2
AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Memory Corruption when processing display command line information due to improper initialization of a variable.

First published (updated )
Severity
7.2
AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Memory corruption while processing fastboot commands with improperly formatted input.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while processing received beacon frame.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

First published (updated )
Severity
6.2
Null Pointer Dereference
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

First published (updated )
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

First published (updated )
Severity
7.8
Double Free
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while retrieving the CBOR data from TA.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing video packets received from video firmware.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS may occur while processing malformed length field in SSID IEs.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while processing an ANQP message.

First published (updated )
Severity
7.5
Input Validation
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while processing CCCH data when NW sends data with invalid length.

First published (updated )
Severity
6.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Information disclosure while processing the hash segment in an MBN file.

First published (updated )
Severity
6.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Information disclosure while reading data from an image using specified offset and size parameters.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while creating NDP instance.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while processing a frame with malformed shared-key descriptor.

First published (updated )
Severity
9.8
Out-of-bounds Read
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while selecting the PLMN from SOR failed list.

First published (updated )
Severity
9.8
Buffer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203