CVE-2025-21421

Memory corruption while processing escape code in API.

CVE-2025-21423

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

CVE-2025-27031

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

CVE-2025-27068

Memory corruption while processing an IOCTL command with an arbitrary address.

CVE-2025-27075

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

CVE-2025-27076

Memory corruption while processing simultaneous requests via escape path.