by Kastro
Paper/Archive/CVE-2024-49846

CVE-2024-49846

Qualcomm, Inc. Snapdragon — Buffer Over-read in Multi-Mode Call Processor

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 21.0.210 × 204.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption while decoding of OTA messages from T3448 IE.

Affected

ProductAffectedFixed inSource
SnapdragonAR8035–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQCA6574AU–CNA
SnapdragonQCA6595AU–CNA
SnapdragonQCA6678AQ–CNA
SnapdragonQCA6688AQ–CNA
SnapdragonQCA6698AQ–CNA
SnapdragonQCA8081–CNA
SnapdragonQCA8337–CNA
SnapdragonQCC710–CNA
SnapdragonQCN6224–CNA
SnapdragonQCN6274–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
qualcomm (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdocs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html