Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Transient DOS may occur while processing the country IE.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
Memory Corruption in WLAN HOST while fetching TX status information.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Information disclosure in IOE Firmware while handling WMI command.
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Transient DOS in Bluetooth Host while rfc slot allocation.
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.