information disclosure while invoking calibration data from user space to update firmware size.
Transient DOS while processing video packets received from video firmware.
Information disclosure while registering commands from clients with diag through diagHal.
Information disclosure when Video engine escape input data is less than expected minimum size.
Transient DOS while handling beacon frames with invalid IE header length.
Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
Transient DOS while processing the EHT operation IE in the received beacon frame.
Transient DOS while processing received beacon frame.
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
Transient DOS may occur while parsing extended IE in beacon.
Transient DOS may occur while parsing SSID in action frames.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Transient DOS while processing IOCTL call for image encoding.
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Information disclosure while parsing dts header atom in Video.
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
Information disclosure may occur while processing goodbye RTCP packet from network.
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
Memory corruption during management frame processing due to mismatch in T2LM info element.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Transient DOS in Data Modem during DTLS handshake.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
Transient DOS may occur while processing malformed length field in SSID IEs.
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Information disclosure in IOE Firmware while handling WMI command.
Information disclosure in WLAN HAL while handling the WMI state info command.
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
Transient DOS while parsing per STA profile in ML IE.
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Information disclosure while running video usecase having rogue firmware.
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Information disclosure in Video while parsing mp2 clip with invalid section length.
Transient DOS while parse fils IE with length equal to 1.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.