Where
-Infinity
0
Severity
6.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

First published (updated )
Severity
8.4
Integer Overflow
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Audio while allocating the ion buffer during the music playback.

First published (updated )
Severity
6.8
Double Free
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in WLAN HOST while fetching TX status information.

First published (updated )
Severity
9.8
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.

First published (updated )
Severity
7.8
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

First published (updated )
Severity
7.8
Use After Free
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while handling session errors from firmware.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing voice packet with arbitrary data received from ADSP.

First published (updated )
Severity
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

First published (updated )
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing GPU page table switch.

First published (updated )
Severity
7.1
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS in Data Modem during DTLS handshake.

First published (updated )
Severity
8.2
EPSS
0.04%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Information disclosure while parsing the OCI IE with invalid length.

First published (updated )
Severity
7.8
Race Condition
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.

First published (updated )
Severity
8.4
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption in Audio during playback with speaker protection.

First published (updated )
Severity
7.8
Buffer Overflow
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

First published (updated )
Severity
9.3
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

First published (updated )
Severity
6.2
Null Pointer Dereference
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESMIEI.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS while processing TID-to-link mapping IE elements.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption when keymaster operation imports a shared key.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption during session sign renewal request calls in HLOS.

First published (updated )
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

First published (updated )
Severity
7.8
Input Validation
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption while processing API calls to NPU with invalid input.

First published (updated )
Severity
8.4
Out-of-bounds Read
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

First published (updated )
Severity
8.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.

First published (updated )
Severity
6.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Information disclosure during audio playback.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203