CVE-2026-21378

all versions

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

7.8HIGH

CVE-2026-21376

all versions

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

7.8HIGH

CVE-2026-21374

all versions

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

7.8HIGH

CVE-2026-21373

all versions

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

7.8HIGH

CVE-2026-21371

all versions

Memory Corruption when retrieving output buffer with insufficient size validation.

7.8HIGH

CVE-2025-47383

all versions

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

7.2HIGH

CVE-2024-43050

all versions

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

7.8HIGH

CVE-2024-33056

all versions

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

8.4HIGH

CVE-2024-33044

all versions

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

8.4HIGH

CVE-2023-43536

all versions

Transient DOS while parse fils IE with length equal to 1.

7.5HIGH

CVE-2023-43533

all versions

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

7.5HIGH

CVE-2023-43522

all versions

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

7.5HIGH

CVE-2023-33076

all versions

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

5.9MEDIUM

CVE-2023-33072

all versions

Memory corruption in Core while processing control functions.

9.3CRITICAL

CVE-2023-43511

all versions

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains IPPROTO_NONE as the n

7.5HIGH

CVE-2023-33110

all versions

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP an

7.8HIGH

CVE-2023-33109

all versions

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

7.5HIGH

CVE-2023-33062

all versions

Transient DOS in WLAN Firmware while parsing a BTM request.

7.5HIGH

CVE-2023-33040

all versions

Transient DOS in Data Modem during DTLS handshake.

7.5HIGH

CVE-2023-33038

all versions

Memory corruption while receiving a message in Bus Socket Transport Server.

6.7MEDIUM

CVE-2023-33036

all versions

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

7.1HIGH

CVE-2023-33033

all versions

Memory corruption in Audio during playback with speaker protection.

8.4HIGH

CVE-2023-33032

all versions

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

9.3CRITICAL

CVE-2023-33030

all versions

Memory corruption in HLOS while running playready use-case.

9.3CRITICAL

CVE-2023-28569

all versions

Information disclosure in WLAN HAL while handling command through WMI interfaces.

6.1MEDIUM

CVE-2023-28568

all versions

Information disclosure in WLAN HAL when reception status handler is called.

6.1MEDIUM

CVE-2023-28566

all versions

Information disclosure in WLAN HAL while handling the WMI state info command.

6.1MEDIUM

CVE-2023-28563

all versions

Information disclosure in IOE Firmware while handling WMI command.

6.1MEDIUM

CVE-2023-28556

all versions

Cryptographic issue in HLOS during key management.

7.1HIGH

CVE-2023-28545

all versions

Memory corruption in TZ Secure OS while loading an app ELF.

8.2HIGH

CVE-2023-24852

all versions

Memory Corruption in Core due to secure memory access by user while loading modem image.

8.4HIGH

CVE-2023-22388

all versions

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

9.8CRITICAL

CVE-2023-28559

all versions

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.

7.8HIGH

CVE-2023-28558

all versions

Memory corruption in WLAN handler while processing PhyID in Tx status handler.

7.8HIGH

CVE-2023-28557

all versions

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.

7.8HIGH

CVE-2023-28549

all versions

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

7.8HIGH

CVE-2023-28548

all versions

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.

7.8HIGH

CVE-2023-28544

all versions

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.

7.8HIGH

CVE-2022-40504

all versions

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

7.5HIGH

CVE-2022-33273

all versions

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.

7.3HIGH