Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Memory corruption in HLOS while checking for the storage type.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption while using the UIM diag command to get the operators name.
Memory corruption while invoking callback function of AFE from ADSP.
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
Memory corruption while processing concurrent IOCTL calls.
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
Memory corruption while processing data packets in diag received from Unix clients.
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Memory corruption in HLOS while converting from authorization token to HIDL vector.
Memory corruption when processing cmd parameters while parsing vdev.
Memory corruption while invoking HGSL IOCTL context create.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Information disclosure in IOE Firmware while handling WMI command.
Memory corruption in video while parsing invalid mp2 clip.