Memory corruption in HLOS while running playready use-case.
Memory corruption in Core while processing control functions.
Memory corruption while processing the IOCTL FM HCI WRITE request.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Memory corruption in TZ Secure OS while loading an app ELF.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key.
Memory corruption while handling IOCTL calls in JPEG Encoder driver.
Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory Corruption when user space address is modified and passed to memfree API, causing kernel memory to be freed inadvertently.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
Memory Corruption when retrieving output buffer with insufficient size validation.
Memory corruption while preprocessing IOCTL request in JPEG driver.
Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
Memory Corruption when copying large input data exceeds normal allocation limits.
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
Memory corruption while processing rear sensor IOCTL calls.