Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Information disclosure in Audio while accessing AVCS services from ADSP payload.
Transient DOS in Audio when invoking callback function of ASM driver.
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
Information disclosure while parsing dts header atom in Video.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Memory corruption when IOCTL call is invoked from user-space to read board data.
Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Memory corruption in DSP Service during a remote call from HLOS to DSP.