Information disclosure during audio playback.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
Information Disclosure in WLAN Host when processing WMI event command.
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Information disclosure in WLAN HAL while handling the WMI state info command.
Information disclosure in WLAN HAL when reception status handler is called.
Information disclosure in IOE Firmware while handling WMI command.
Information disclosure while processing information on firmware image during core initialization.
Information disclosure while processing IO control commands.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Information disclosure while processing message from client with invalid payload.
Information disclosure while processing a firmware event.
information disclosure while invoking calibration data from user space to update firmware size.
Information disclosure while running video usecase having rogue firmware.
Information disclosure while opening a fastrpc session when domain is not sanitized.
Information disclosure when Video engine escape input data is less than expected minimum size.
Information disclosure while processing batch command execution in Video driver.
information disclosure while invoking the mailbox read API.
Transient DOS in Data Modem during DTLS handshake.
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
Transient DOS while processing the CU information from RNR IE.
Transient DOS while parsing probe response and assoc response frame.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Information disclosure in modem due to improper check of IP type while processing DNS server query
Information disclosure in modem due to buffer over-read while processing response from DNS server
Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Information disclosure in modem due to buffer over-red while performing checksum of packet received
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while processing TID-to-link mapping IE elements.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.
Memory corruption when the captureRead QDCM command is invoked from user-space.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Transient DOS while parsing the received TID-to-link mapping action frame.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.