CVE-2025-47377
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
CVE-2025-47366
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
CVE-2025-47369
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
CVE-2025-47319
Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
CVE-2025-47370
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
CVE-2025-27041
Transient DOS while processing video packets received from video firmware.
CVE-2025-47326
Transient DOS while handling command data during power control processing.
CVE-2025-27065
Transient DOS while processing a frame with malformed shared-key descriptor.
CVE-2025-21457
Information disclosure while opening a fastrpc session when domain is not sanitized.
CVE-2025-21456
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
CVE-2025-27057
Transient DOS while handling beacon frames with invalid IE header length.
CVE-2025-27052
Memory corruption while processing data packets in diag received from Unix clients.
CVE-2025-27043
Memory corruption while processing manipulated payload in video firmware.
CVE-2025-21450
Cryptographic issue occurs due to use of insecure connection method while downloading.
CVE-2025-21463
Transient DOS while processing the EHT operation IE in the received beacon frame.
CVE-2025-21468
Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
CVE-2025-21459
Transient DOS while parsing per STA profile in ML IE.
CVE-2024-49847
Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
CVE-2024-49844
Memory corruption while triggering commands in the PlayReady Trusted application.
CVE-2025-21435
Transient DOS may occur while parsing extended IE in beacon.