Where
-Infinity
0
Severity
9.3
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Memory corruption in Core while processing control functions.

First published (updated )
Severity
9.3
Input Validation
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Memory corruption in Core Services while executing the command for removing a single event listener.

First published (updated )
Severity
9.3
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

First published (updated )
Severity
9
Input Validation
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Memory corruption in core services when Diag handler receives a command to configure event listeners.

First published (updated )
Severity
8.8
Input Validation
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Memory corruption while configuring a Hypervisor based input virtual device.

First published (updated )
Severity
8.8
Buffer Overflow
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Memory corruption while loading an ELF segment in TEE Kernel.

First published (updated )
Severity
8.7
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Improper Access to the VM resource manager can lead to Memory Corruption.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while invoking HGSL IOCTL context create.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while invoking IOCTLs calls in Automotive Multimedia.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in SPS Application while requesting for public key in sorter TA.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing finishsign command to pass a rsp buffer.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while verifying the serialized header when the key pairs are generated.

First published (updated )
Severity
8.4
Double Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

First published (updated )
Severity
8.4
Buffer Overflow
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing IOCTL call to set metainfo.

First published (updated )
Severity
8.4
Integer Overflow
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while allocating memory in HGSL driver.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when two threads try to map and unmap a single node simultaneously.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

First published (updated )
Severity
8.4
Out-of-bounds Read
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Cryptographic issue may occur while encrypting license data.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

First published (updated )
Severity
8.4
Input Validation
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in HLOS while registering for key provisioning notify.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in DSP Service during a remote call from HLOS to DSP.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Core due to secure memory access by user while loading modem image.

First published (updated )
Severity
8.4
Integer Overflow
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in HLOS while invoking IOCTL calls from user-space.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203