Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Memory corruption when multiple listeners are being registered with the same file descriptor.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption when user provides data for FM HCI command control operations.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption when the IOCTL call is interrupted by a signal.
Transient DOS while parsing per STA profile in ML IE.
Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Memory corruption in Automotive Multimedia due to improper access control in HAB.
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.
Information disclosure while parsing the OCI IE with invalid length.