Skip to content
Fencer Vulns
medium 6.7

CVE-2024-23379 json

Double Free in DSP Services

published 2024-10-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-20883

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Qualcomm, Inc. Snapdragon
  • qualcomm fastconnect_6900_firmware
  • qualcomm fastconnect_7800_firmware
  • qualcomm qam8255p_firmware
  • qualcomm qam8650p_firmware
  • qualcomm qam8775p_firmware
  • qualcomm qamsrv1h_firmware
  • qualcomm qamsrv1m_firmware
  • qualcomm qca6310_firmware
  • qualcomm qca6320_firmware
  • qualcomm qca6584au_firmware
  • qualcomm qca6698aq_firmware
  • qualcomm sa7255p_firmware
  • qualcomm sa7775p_firmware
  • qualcomm sa8255p_firmware
  • qualcomm sa8620p_firmware
  • qualcomm sa8650p_firmware
  • qualcomm sa8770p_firmware
  • qualcomm sa8775p_firmware
  • qualcomm sa9000p_firmware
  • qualcomm sd835_firmware
  • qualcomm snapdragon_8_gen_1_mobile_platform_firmware
  • qualcomm snapdragon_835_mobile_pc_platform_firmware
  • qualcomm snapdragon_auto_5g_modem-rf_gen_2_firmware
  • qualcomm srv1h_firmware
  • qualcomm srv1m_firmware
  • qualcomm wcd9335_firmware
  • qualcomm wcd9340_firmware
  • qualcomm wcd9341_firmware
  • qualcomm wcd9380_firmware
  • qualcomm wcn3990_firmware
  • qualcomm wsa8810_firmware
  • qualcomm wsa8815_firmware
  • qualcomm wsa8830_firmware
  • qualcomm wsa8835_firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.