Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Memory Corruption when accessing buffers with invalid length during TA invocation.
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
Memory corruption while using alignments for memory allocation.
Memory corruption while processing identity credential operations in the trusted application.
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Information disclosure while processing a firmware event.
Transient DOS while parsing video packets received from the video firmware.
Memory corruption while routing GPR packets between user and root when handling large data packet.
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.
Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption while processing command in Glink linux.
Information disclosure while deriving keys for a session for any Widevine use case.
Memory corruption in display driver while detaching a device.
Transient DOS may occur while processing the country IE.
Memory corruption may occur while validating ports and channels in Audio driver.
Information disclosure while processing IO control commands.
Information disclosure while processing information on firmware image during core initialization.
Memory corruption while parsing the memory map info in IOCTL calls.
Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Memory corruption when Alternative Frequency offset value is set to 255.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS during music playback of ALAC content.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.