Skip to content
Fencer Vulns
high 7.8

CVE-2024-43047 kev in the critical feed json

Use After Free in DSP Service

published 2024-10-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-40024

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2024-10-08
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Memory corruption while maintaining memory maps of HLOS memory.

Patch / fix

cisa required action Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Timeline

  1. Found exploited as a 0-day (Project Zero)
  2. 0-day patched (Project Zero)
  3. Published
  4. Added to CISA KEV
  5. CISA SSVC: exploitation active
  6. CISA patch deadline

Known exploited

Added
2 y ago
Patch by
2024-10-29 (2 y ago)
Ransomware
Not known
Required action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Vendor, product
Qualcomm, Multiple Chipsets
CISA name
Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found
2024-07-29
Patched
2024-10-07
Details
project zero tracker

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Qualcomm, Inc. Snapdragon
  • qualcomm fastconnect_6700_firmware
  • qualcomm fastconnect_6800_firmware
  • qualcomm fastconnect_6900_firmware
  • qualcomm fastconnect_7800_firmware
  • qualcomm qam8295p_firmware
  • qualcomm qca6174a_firmware
  • qualcomm qca6391_firmware
  • qualcomm qca6426_firmware
  • qualcomm qca6436_firmware
  • qualcomm qca6574au_firmware
  • qualcomm qca6584au_firmware
  • qualcomm qca6595_firmware
  • qualcomm qca6595au_firmware
  • qualcomm qca6688aq_firmware
  • qualcomm qca6696_firmware
  • qualcomm qca6698aq_firmware
  • qualcomm qcs410_firmware
  • qualcomm qcs610_firmware
  • qualcomm qcs6490_firmware
  • qualcomm qualcomm_video_collaboration_vc1_platform_firmware
  • qualcomm qualcomm_video_collaboration_vc3_platform_firmware
  • qualcomm sa4150p_firmware
  • qualcomm sa4155p_firmware
  • qualcomm sa6145p_firmware
  • qualcomm sa6150p_firmware
  • qualcomm sa6155p_firmware
  • qualcomm sa8145p_firmware
  • qualcomm sa8150p_firmware
  • qualcomm sa8155p_firmware
  • qualcomm sa8195p_firmware
  • qualcomm sa8295p_firmware
  • qualcomm sd660_firmware
  • qualcomm sd865_5g_firmware
  • qualcomm sg4150p_firmware
  • qualcomm snapdragon_660_mobile_platform_firmware
  • qualcomm snapdragon_680_4g_mobile_platform_firmware
  • qualcomm snapdragon_8_gen_1_mobile_platform_firmware
  • qualcomm snapdragon_865_5g_mobile_platform_firmware
  • qualcomm snapdragon_888_5g_mobile_platform_firmware
  • qualcomm snapdragon_auto_5g_modem-rf_firmware
  • qualcomm snapdragon_auto_5g_modem-rf_gen_2_firmware
  • qualcomm snapdragon_x55_5g_modem-rf_system_firmware
  • qualcomm snapdragon_xr2_5g_platform_firmware
  • qualcomm sw5100_firmware
  • qualcomm sw5100p_firmware
  • qualcomm sxr2130_firmware
  • qualcomm wcd9335_firmware
  • qualcomm wcd9341_firmware
  • qualcomm wcd9370_firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.