Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Information disclosure while registering commands from clients with diag through diagHal.
Information disclosure when Video engine escape input data is less than expected minimum size.
Information disclosure while processing message from client with invalid payload.
information disclosure while invoking the mailbox read API.
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Information Disclosure in WLAN Host when processing WMI event command.
Information disclosure in WLAN HAL when reception status handler is called.
Information disclosure in WLAN HAL while handling the WMI state info command.
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Information disclosure in IOE Firmware while handling WMI command.
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
information disclosure while invoking calibration data from user space to update firmware size.
Information disclosure while running video usecase having rogue firmware.
Information disclosure while opening a fastrpc session when domain is not sanitized.
Information disclosure while processing a firmware event.
Information disclosure while processing IO control commands.
Information disclosure during audio playback.
Information disclosure while processing information on firmware image during core initialization.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
Information disclosure in Video while parsing mp2 clip with invalid section length.
Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0.
Information disclosure while parsing the multiple MBSSID IEs from the beacon.
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
Transient DOS while processing TID-to-link mapping IE elements.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing the received TID-to-link mapping action frame.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Information disclosure while handling beacon or probe response frame in STA.
Information Disclosure while parsing beacon frame in STA.
Information disclosure while handling SA query action frame.
Memory corruption while processing key blob passed by the user.
Transient DOS while loading the TA ELF file.
Transient DOS while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
Transient DOS in WLAN Firmware while processing frames with missing header fields.