Search vulnerabilities
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Improper Validation of Array Index in Kernel
Memory corruption in Kernel while parsing metadata.
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Buffer Over-read in WLAN HOST
Memory Corruption in WLAN HOST while fetching TX status information.
Use After Free in WLAN Host Communication
Memory corruption while processing MBSSID beacon containing several subelement IE.
Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Buffer Over-read in WLAN Host Communication
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
Buffer over-read in WLAN Firmware
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.
Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Buffer Over-read in IOE Firmware
Information disclosure in IOE Firmware while handling WMI command.
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.
NULL Pointer Dereference in WLAN Firmware
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while processing RT proxy port register driver.
NULL Pointer Dereference in WLAN Firmware
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the calibration data returned from ACDB loader.