Search vulnerabilities
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Improper Validation of Array Index in HLOS
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer.
Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS
Memory corruption in TZ Secure OS while loading an app ELF.
Improper Input Validation in Modem
Transient DOS in Modem after RRC Setup message is received.
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
Buffer Over-read in Data Modem
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Buffer Copy Without Checking Size of Input in Audio
Memory corruption while invoking callback function of AFE from ADSP.
Buffer Over-read in WLAN HOST
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Buffer Copy Without Checking Size of Input in WLAN Host
Transient DOS may occur while processing the country IE.
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Use After Free in HLOS
Memory corruption when multiple listeners are being registered with the same file descriptor.
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
Buffer Over-read in WLAN Firmware
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Improper Authentication in GPS HLOS Driver
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.