Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.

Memory corruption due to use after free in trusted application environment.

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

Memory corruption due to use after free in Core when multiple DCI clients register and deregister.

Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernel. in Snapdragon Mobile

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.

Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.