Log in Start free

Actively exploited · Published Oct 7, 2024 · Assigned by qualcomm

CVE-2024-43047Use After Free in DSP Service

High 7.8 Exploited

In plain English

A high-severity use-after-free in Snapdragon from Qualcomm, Inc.. Attackers are actively exploiting it in the wild (listed by CISA on October 8, 2024). The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildYesCISA KEV since Oct 8, 2024
Attack toolingNoneno public tooling known

CISA guidance

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Federal agencies must remediate by Oct 29, 2024.

Official description

Memory corruption while maintaining memory maps of HLOS memory.

Affected products (as reported)

VendorProductVersions
Qualcomm, Inc. Snapdragon FastConnect 6700FastConnect 6800FastConnect 6900FastConnect 7800QAM8295PQCA6174AQCA6391QCA6426

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References