Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Memory corruption in Core Platform while printing the response buffer in log.
Memory corruption in Linux while calling system configuration APIs.
Memoru corruption in Audio when ADSP sends input during record use case.
Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Memory Corruption due to improper validation of array index in Linux while updating adn record.
Memory Corruption in Core during syscall for Sectools Fuse comparison feature.
An app with non-privileged access can change global system brightness and cause undesired system behavior.
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Memory Corruption while accessing metadata in Display.
Memory corruption in Graphics while importing a file.
Memory corruption due to untrusted pointer dereference in automotive during system call.
Memory corruption when user provides data for FM HCI command control operations.
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
Memory corruption in Automotive GPU while querying a gsl memory node.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory Corruption in Core Platform while printing the response buffer in log.
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
Memory corruption in HAB Memory management due to broad system privileges via physical address.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Memory corruption in RIL while trying to send apdu packet.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption in WLAN HOST while receiving an WMI event from firmware.
Memory corruption in Linux when the file upload API is called with parameters having large buffer.
Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.
Memory corruption in Audio during playback session with audio effects enabled.
Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
Memory corruption while processing frame command IOCTL calls.
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
Initial xbl_sec revision does not have all the debug policy features and critical checks.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND, a userspace buffer is directly accessed in kernel space.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving correct information.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
Memory corruption due to stack-based buffer overflow in Core
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Memory corruption in Automotive Android OS due to improper validation of array index.
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
Memory corruption in core due to stack-based buffer overflow
Memory corruption due to improper validation of array index in Audio.