Memory corruption while processing TPC target power table in FTM TPC.
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
information disclosure while invoking the mailbox read API.
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Memory corruption when kernel driver attempts to trigger hardware fences.
Memory corruption while processing graphics kernel driver request to create DMA fence.