Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing the received TID-to-link mapping action frame.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Information disclosure while handling beacon or probe response frame in STA.
Information Disclosure while parsing beacon frame in STA.
Information disclosure while handling SA query action frame.
Memory corruption while processing key blob passed by the user.
Transient DOS while loading the TA ELF file.
Transient DOS while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
Transient DOS in WLAN Firmware while processing frames with missing header fields.
Memory Corruption in WLAN HOST while fetching TX status information.
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Memory Corruption when adding user-supplied data without checking available buffer space.
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
Memory corruption while decoding of OTA messages from T3448 IE.
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Transient DOS during music playback of ALAC content.
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS due to buffer over-read in WLAN Host while parsing frame information.
Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length.
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
Information disclosure due to buffer over-read in modem while reading configuration parameters.
Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
Information disclosure in modem due to buffer over read in dns client due to missing length check
Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message
Information disclosure in modem due to improper check of IP type while processing DNS server query