Integer Overflow or Wraparound in Core Services
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption in Audio while processing RT proxy port register driver.
Memory Corruption in WLAN HOST while fetching TX status information.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS in Bluetooth Host while rfc slot allocation.
Transient DOS in WLAN Firmware while parsing a BTM request.
Memory corruption while playing audio file having large-sized input buffer.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Memory corruption while processing audio effects.
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.