by Kastro
Paper/Archive/CVE-2023-43519

CVE-2023-43519

Qualcomm, Inc. Snapdragon — Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 18.4.184 × 203.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Affected

ProductAffectedFixed inSource
SnapdragonAQT1000–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQAM8255P–CNA
SnapdragonQAM8295P–CNA
SnapdragonQAM8650P–CNA
SnapdragonQAM8775P–CNA
SnapdragonQAMSRV1H–CNA
SnapdragonQAMSRV1M–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/february-2024-bulletin