by Kastro
Paper/Archive/CVE-2024-21463

CVE-2024-21463

Qualcomm, Inc. Snapdragon — Buffer Copy Without Checking Size of Input in Audio

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 21.7.217 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Affected

ProductAffectedFixed inSource
SnapdragonAR8035–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQAM8255P–CNA
SnapdragonQAM8295P–CNA
SnapdragonQAM8650P–CNA
SnapdragonQAM8775P–CNA
SnapdragonQAMSRV1H–CNA
SnapdragonQAMSRV1M–CNA
SnapdragonQCA6174A–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.qualcomm.com/product/publicresources/securitybulletin/april-2024-bulletin.html