Where
-Infinity
0
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while invoking HGSL IOCTL context create.

First published (updated )
Severity
7.8
Integer Overflow
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while invoking IOCTLs calls in Automotive Multimedia.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when there is failed unmap operation in GPU.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

First published (updated )
Severity
7.8
Buffer Overflow
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption when the payload received from firmware is not as per the expected protocol size.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when two threads try to map and unmap a single node simultaneously.

First published (updated )
Severity
7.8
Use After Free
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing IOCTL call for getting group info.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

First published (updated )
Severity
7.8
EPSS
0.02%
Out-of-bounds Read
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while power-up or power-down sequence of the camera sensor.

First published (updated )
Severity
7.8
Null Pointer Dereference
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in display driver while detaching a device.

First published (updated )
Severity
7.8
Use After Free
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while calling the NPU driver APIs concurrently.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS may occur while processing the country IE.

First published (updated )
Severity
7.8
Out-of-bounds Read
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption may occur while validating ports and channels in Audio driver.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

First published (updated )
Severity
7.8
Use After Free
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while reading the FW response from the shared queue.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Graphics while processing user packets for command submission.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing video packets received from video firmware.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

First published (updated )
Severity
7.8
Use After Free
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in WLAN HOST while parsing QMI response message from firmware.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in WLAN HOST while fetching TX status information.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203