CVE-2024-43047

Memory corruption while maintaining memory maps of HLOS memory.

CVE-2025-21424

Memory corruption while calling the NPU driver APIs concurrently.

CVE-2023-43513

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

CVE-2024-38402

Memory corruption while processing IOCTL call for getting group info.

CVE-2024-33063

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

CVE-2024-45558

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

CVE-2025-21459

Transient DOS while parsing per STA profile in ML IE.

CVE-2023-43533

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

CVE-2024-53027

Transient DOS may occur while processing the country IE.

CVE-2023-43536

Transient DOS while parse fils IE with length equal to 1.

CVE-2025-21453

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

CVE-2024-53024

Memory corruption in display driver while detaching a device.

CVE-2024-33048

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

CVE-2024-21455

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

CVE-2024-33050

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

CVE-2024-45553

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

CVE-2024-53014

Memory corruption may occur while validating ports and channels in Audio driver.

CVE-2024-33049

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

CVE-2024-33057

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

CVE-2024-38422

Memory corruption while processing voice packet with arbitrary data received from ADSP.

CVE-2024-49835

Memory corruption while reading secure file.

CVE-2024-33069

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

CVE-2024-38421

Memory corruption while processing GPU commands.

CVE-2024-21465

Memory corruption while processing key blob passed by the user.

CVE-2023-43522

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

CVE-2025-21460

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

CVE-2024-49845

Memory corruption during the FRS UDS generation process.

CVE-2024-49847

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

CVE-2024-38405

Transient DOS while processing the CU information from RNR IE.

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application.

CVE-2024-38397

Transient DOS while parsing probe response and assoc response frame.

CVE-2024-43064

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

CVE-2024-45564

Memory corruption during concurrent access to server info object due to incorrect reference count update.

CVE-2024-45562

Memory corruption during concurrent access to server info object due to unprotected critical field.

CVE-2024-49837

Memory corruption while reading CPU state data during guest VM suspend.

CVE-2024-49844

Memory corruption while triggering commands in the PlayReady Trusted application.

CVE-2024-45581

Memory corruption while sound model registration for voice activation with audio kernel driver.

CVE-2024-53012

Memory corruption may occur due to improper input validation in clock device.

CVE-2024-33051

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

CVE-2024-49842

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

CVE-2024-33013

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

CVE-2024-49830

Memory corruption while processing an IOCTL call to set mixer controls.

CVE-2024-49841

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVE-2024-53011

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

CVE-2024-53031

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

CVE-2024-53023

Memory corruption may occur while accessing a variable during extended back to back tests.

CVE-2024-53028

Memory corruption may occur while processing message from frontend during allocation.

CVE-2024-53032

Memory corruption may occur in keyboard virtual device due to guest VM interaction.

CVE-2024-21462

Transient DOS while loading the TA ELF file.

CVE-2024-33026

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.