{"id":"CVE-2024-43047","kind":"vulnerability","aliases":["CVE-2024-43047"],"related":[],"title":"Memory corruption while maintaining memory maps of HLOS memory","description":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"A use-after-free memory corruption bug in DSP Services on multiple Qualcomm chipsets lets software corrupt memory used to map high-level OS memory. CISA reports it is being exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-10-08T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6900 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8295p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6174a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6426 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6436 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6584au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6595 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6595au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6688aq firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6696 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6698aq firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs410 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs610 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs6490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm video collaboration vc1 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm video collaboration vc3 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa4150p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa4155p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa6145p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa6150p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa6155p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8145p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8150p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8155p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8195p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8295p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd660 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd865 5g firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sg4150p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 660 mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 680 4g mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 685 4g mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 8 gen 1 mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 865 5g mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm snapdragon 865\\+ 5g mobile firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","embedded","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor remediation from Qualcomm's security bulletin or discontinue use of affected devices if no fix is available; the sources do not name patched versions.","status":"open","published_at":"2024-10-07T13:15:15+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:31+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:56:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor remediation from Qualcomm's security bulletin or discontinue use of affected devices if no fix is available; the sources do not name patched versions.","reach":"local","impact":"high","summary":"A use-after-free memory corruption bug in DSP Services on multiple Qualcomm chipsets lets software corrupt memory used to map high-level OS memory. CISA reports it is being exploited in the wild.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may corrupt kernel-adjacent memory and possibly gain elevated privileges on device","analyst_note":"Find the Qualcomm security bulletin and the affected chipset/firmware list for CVE-2024-43047 and the patched firmware or Android security patch level; the sources give no affected or fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000479,"input_tokens":2844,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,14A '-43047':12A,15A '1':153A '4g':140A,146A '5g':127A,159A,165A '660':134A '6700':21A '680':139A '6800':25A '685':145A '6900':29A '7800':33A '8':151A '865':158A,164A 'action':238C 'android':168B 'appli':239C 'bug':183B 'chipset':190B,214C 'chipsets':18A 'cisa':203B,236C 'collaboration':82A,88A 'contain':215C 'corrupt':2A,182B,193B,225C 'cve':10A,13A 'devic':174B 'discontinu':247C 'dsp':185B,227C 'due':222C 'embed':169B 'exploit':170B,208B 'fastconnect':20A,24A,28A,32A 'firmware':22A,26A,30A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,85A,91A,94A,97A,100A,103A,106A,109A,112A,115A,118A,121A,124A,128A,131A,136A,142A,148A,155A,161A,167A 'free':180B,220C 'gen':152A 'high':199B 'high-level':198B 'hlos':8A,234C 'infrastructur':171B 'instruct':245C 'let':191B 'level':200B 'maintain':4A,230C 'map':6A,197B,232C 'memori':1A,5A,9A,181B,194B,202B,224C,231C,235C 'mitig':242C,255C 'mobil':173B 'mobile':135A,141A,147A,154A,160A,166A 'mobile-devic':172B 'multipl':188B,212C 'multiple':17A 'os':201B 'per':243C 'platform':84A,90A 'product':251C 'qam8295p':36A 'qca6174a':39A 'qca6391':42A 'qca6426':45A 'qca6436':48A 'qca6574au':51A 'qca6584au':54A 'qca6595':57A 'qca6595au':60A 'qca6688aq':63A 'qca6696':66A 'qca6698aq':69A 'qcs410':72A 'qcs610':75A 'qcs6490':78A 'qualcomm':16A,19A,23A,27A,31A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,86A,92A,95A,98A,101A,104A,107A,110A,113A,116A,119A,122A,125A,129A,132A,137A,143A,149A,156A,162A,175B,189B,213C 'remedi':240C,253C 'report':204B 'requir':237C 'sa4150p':93A 'sa4155p':96A 'sa6145p':99A 'sa6150p':102A 'sa6155p':105A 'sa8145p':108A 'sa8150p':111A 'sa8155p':114A 'sa8195p':117A 'sa8295p':120A 'sd660':123A 'sd865':126A 'servic':186B,228C 'sg4150p':130A 'snapdragon':133A,138A,144A,150A,157A,163A 'softwar':192B 'unavail':257C 'use':178B,195B,218C,248C 'use-after-fre':177B,217C 'vc1':83A 'vc3':89A 'vendor':244C 'video':81A,87A 'vulner':221C 'wild':211B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-07T13:15:15+00:00","kev":{"dateAdded":"2024-10-08","dueDate":"2024-10-29","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-43047","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43047","severity":null,"published_at":"2024-10-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-43047","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43047","severity":null,"published_at":"2024-10-07T13:15:15+00:00","modified_at":"2026-06-17T07:50:18+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}