Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Memory corruption during session sign renewal request calls in HLOS.
Memory corruption while processing key blob passed by the user.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption while handling payloads from remote ESL.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
Memory corruption in QESL while processing payload from external ESL device to firmware.
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
Memory Corruption in Core due to incorrect type conversion or cast in secureioread/write function in TEE.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Information disclosure in Kernel due to indirect branch misprediction.
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
Memory corruption in WLAN due to use after free
Memory corruption in Bluetooth HOST while processing the AVRCPDUGETPLAYERAPPVALUETEXT AVRCP response.
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.