Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
Memory corruption while processing fastboot commands with improperly formatted input.
Memory Corruption when processing display command line information due to improper initialization of a variable.
Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
Memory Corruption when processing device identifier strings that exceed the expected maximum length.
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
Memory corruption while using alignments for memory allocation.
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Transient DOS when MAC configures config id greater than supported maximum value.
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory corruption while handling session errors from firmware.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption in Core while processing control functions.
Transient DOS while parse fils IE with length equal to 1.