CVE-2024-45561

Memory corruption while handling IOCTL call from user-space to set latency level.

CVE-2024-53023

Memory corruption may occur while accessing a variable during extended back to back tests.

CVE-2024-53033

Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.

CVE-2024-53034

Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.

CVE-2025-27029

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

CVE-2024-38412

Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.

CVE-2024-45550

Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.

CVE-2024-53025

Transient DOS can occur while processing UCI command.

CVE-2025-21447

Memory corruption may occur while processing device IO control call for session control.

CVE-2024-38404

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

CVE-2024-38420

Memory corruption while configuring a Hypervisor based input virtual device.

CVE-2024-43051

Information disclosure while deriving keys for a session for any Widevine use case.

CVE-2024-45542

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2024-45560

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

CVE-2024-45584

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

CVE-2024-45548

Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.

CVE-2025-21421

Memory corruption while processing escape code in API.

CVE-2025-21441

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2025-21423

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

CVE-2025-21440

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVE-2025-27031

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

CVE-2024-43056

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

CVE-2024-45583

Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.

CVE-2024-53019

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

CVE-2024-45557

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.

CVE-2025-27057

Transient DOS while handling beacon frames with invalid IE header length.

CVE-2025-27061

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

CVE-2025-27042

Memory corruption while processing video packets received from video firmware.

CVE-2025-27043

Memory corruption while processing manipulated payload in video firmware.

CVE-2025-21422

Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.

CVE-2025-21450

Cryptographic issue occurs due to use of insecure connection method while downloading.

CVE-2025-27052

Memory corruption while processing data packets in diag received from Unix clients.

CVE-2024-53009

Memory corruption while operating the mailbox in Automotive.

CVE-2025-21466

Memory corruption while processing a private escape command in an event trigger.

CVE-2025-27046

Memory corruption while processing multiple simultaneous escape calls.

CVE-2025-27051

Memory corruption while processing command message in WLAN Host.

CVE-2025-27055

Memory corruption during the image encoding process.

CVE-2025-21427

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

CVE-2025-21432

Memory corruption while retrieving the CBOR data from TA.

CVE-2025-21433

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

CVE-2025-21446

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

CVE-2025-27047

Memory corruption while processing the TESTPATTERNCONFIG escape path.

CVE-2025-27050

Memory corruption while processing event close when client process terminates abruptly.

CVE-2025-27056

Memory corruption during sub-system restart while processing clean-up to free up resources.

CVE-2025-27058

Memory corruption while processing packet data with exceedingly large packet.

CVE-2025-27044

Memory corruption while executing timestamp video decode command with large input values.

CVE-2025-21477

Transient DOS while processing CCCH data when NW sends data with invalid length.

CVE-2025-27068

Memory corruption while processing an IOCTL command with an arbitrary address.

CVE-2025-27073

Transient DOS while creating NDP instance.

CVE-2025-27076

Memory corruption while processing simultaneous requests via escape path.