Where
-Infinity
0
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

First published (updated )
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.

First published (updated )
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

First published (updated )
Severity
9.3
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

First published (updated )
Severity
9.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.

First published (updated )
Severity
9.3
Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.

First published (updated )
Severity
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Information disclosure in Modem while processing SIB5.

First published (updated )
Severity
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

First published (updated )
Severity
9
Input Validation
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Memory corruption in core services when Diag handler receives a command to configure event listeners.

First published (updated )
Severity
8.8
Input Validation
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Memory corruption while configuring a Hypervisor based input virtual device.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Audio during playback with speaker protection.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption when size of buffer from previous call is used without validation or re-initialization.

First published (updated )
Severity
8.4
Use After Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.

First published (updated )
Severity
8.4
Double Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

First published (updated )
Severity
8.4
Use After Free
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.

First published (updated )
Severity
8.4
Out-of-bounds Read
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

First published (updated )
Severity
8.4
Incorrect Type Cast
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Graphics while importing a file.

First published (updated )
Severity
8.4
Double Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption due to double free in Core while mapping HLOS address to the list.

First published (updated )
Severity
8.2
EPSS
0.04%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Information disclosure while parsing the OCI IE with invalid length.

First published (updated )
Severity
7.8
Race Condition
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.

First published (updated )
Severity
7.8
Integer Overflow
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Memory corruption while receiving a message in Bus Socket Transport Server.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing key blob passed by the user.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption when an invoke call and a TEE call are bound for the same trusted application.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption when keymaster operation imports a shared key.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption during session sign renewal request calls in HLOS.

First published (updated )
Severity
7.8
Use After Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while handling session errors from firmware.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing GPU page table switch.

First published (updated )
Severity
7.8
Out-of-bounds Read
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in WLAN handler while processing PhyID in Tx status handler.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203