Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet
Transient DOS while handling command data during power control processing.
Memory corruption while preprocessing IOCTL request in JPEG driver.
Transient DOS when processing a received frame with an excessively large authentication information element.
Information disclosure in modem due to buffer over-read while processing response from DNS server
Cryptographic issue while copying data to a destination buffer without validating its size.
Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
Transient DOS when processing target power rate tables during channel configuration.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
Transient DOS while processing power control requests with invalid antenna or stream values.
Transient DOS while parsing the EPTM test control message to get the test pattern.
Transient DOS in Audio when invoking callback function of ASM driver.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS in WLAN Firmware while parsing rsn ies.
Information disclosure in Modem while processing SIB5.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS while parsing video packets received from the video firmware.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS in Data Modem during DTLS handshake.
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
Transient DOS in Audio while remapping channel buffer in media codec decoding.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Transient DOS in WLAN Firmware while parsing FT Information Elements.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Information disclosure in modem due to buffer over-red while performing checksum of packet received
Memory corruption during the image encoding process.
Memory corruption while processing an IOCTL command with an arbitrary address.
Transient DOS while processing IOCTL call for image encoding.
Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.