CVE-2025-27029

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

CVE-2025-27057

Transient DOS while handling beacon frames with invalid IE header length.

CVE-2025-27061

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVE-2025-27042

Memory corruption while processing video packets received from video firmware.

CVE-2025-27043

Memory corruption while processing manipulated payload in video firmware.

CVE-2025-27065

Transient DOS while processing a frame with malformed shared-key descriptor.