Buffer Copy Without Checking Size of Input in Video
Memory corruption while parsing qcp clip with invalid chunk data size.
Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Memory corruption while parsing qcp clip with invalid chunk data size.
Information disclosure in Video while parsing mp2 clip with invalid section length.
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption when Alternative Frequency offset value is set to 255.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
Information disclosure while deriving keys for a session for any Widevine use case.
Transient DOS during hypervisor virtual I/O operation in a virtual machine.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption while operating the mailbox in Automotive.
Transient DOS may occur while processing the country IE.
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.