Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption while processing command in Glink linux.
Memory corruption in display driver while detaching a device.
Memory corruption may occur while validating ports and channels in Audio driver.
Possible out of bound access in audio module due to lack of validation of user provided input.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory Corruption while accessing metadata in Display.
Memory corruption in Audio while validating and mapping metadata.
Information disclosure in Automotive multimedia due to buffer over-read.
Transient DOS in Modem while processing invalid System Information Block 1.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
Memory Corruption in Core due to incorrect type conversion or cast in secureioread/write function in TEE.
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
Memory Corruption in Audio while playing amrwbplus clips with modified content.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
Memory corruption in Bluetooth HOST while processing the AVRCPDUGETPLAYERAPPVALUETEXT AVRCP response.
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.