Memory corruption while selecting the PLMN from SOR failed list.
Memory corruption in Core while processing control functions.
Memory corruption in Core Services while executing the command for removing a single event listener.
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Cryptographic issue may occur while encrypting license data.
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while processing key blob passed by the user.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption when keymaster operation imports a shared key.
Memory corruption during session sign renewal request calls in HLOS.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption during GNSS HAL process initialization.
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.