CVE-2024-43047highunder attackCWE-416

CVE-2024-43047: high-severity vulnerability in Qualcomm, Inc. Snapdragon

Use After Free in DSP Service

Published · Updated

Follow this CVE+ Monitor Snapdragon

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 0.7%
from disclosure to weapon
Published on NVDOct 7
CISA KEV+1d
Action required by CISAfederal deadline: 2024-10-29

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

In short

A program tries to use memory that has already been freed, causing it to access invalid data or crash. This can lead to system instability or allow an attacker to execute harmful code on the device.

Technical detail

Use-after-free vulnerability in DSP service memory map management affecting HLOS memory. An attacker with local access can trigger memory corruption by referencing freed memory regions, potentially achieving code execution with elevated privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Memory corruption while maintaining memory maps of HLOS memory.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Qualcomm, Inc. · Snapdragon
Related CVEs — Qualcomm, Inc. Snapdragon

In the same product, most dangerous first.

CVE-2026-21385HIGHInteger Overflow or Wraparound in GraphicsEPSS 1.3%KEVCVE-2025-27038HIGHUse After Free in GraphicsEPSS 1.0%KEVCVE-2023-33106HIGHUse of Out-of-range Pointer Offset in GraphicsEPSS 0.8%KEVCVE-2025-21479HIGHIncorrect Authorization in GraphicsEPSS 0.8%KEVCVE-2023-33107HIGHInteger Overflow or Wraparound in Graphics LinuxEPSS 0.7%KEVCVE-2023-33063HIGHUse After Free in DSP ServicesEPSS 0.7%KEV