Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
Information disclosure in Automotive multimedia due to buffer over-read.
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.
Information disclosure due to buffer overread in Linux sensors
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Transient DOS while parse fils IE with length equal to 1.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Information disclosure while parsing dts header atom in Video.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
Information Disclosure in WLAN Host when processing WMI event command.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Transient DOS in Audio when invoking callback function of ASM driver.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Information Disclosure while processing IOCTL request in FastRPC.
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS in WLAN Firmware while parsing rsn ies.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Transient DOS in Data Modem during DTLS handshake.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Information disclosure in IOE Firmware while handling WMI command.
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Transient DOS in Audio while remapping channel buffer in media codec decoding.
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Information disclosure in WLAN HAL while handling the WMI state info command.
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
Information disclosure in WLAN HAL when reception status handler is called.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
Transient DOS while parsing WLAN beacon or probe-response frame.
Memory Corruption in WLAN HOST while fetching TX status information.
Transient DOS in WLAN Firmware while processing frames with missing header fields.
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.