#VU103534 Use After Free in Qualcomm products - CVE-2024-38412
Vulnerability identifier: #VU103534
Vulnerability risk: Low
CVSSv4.0: 4.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
FastConnect 7800
Mobile applications /
Mobile firmware & hardware
Snapdragon 8 Gen 3 Mobile Platform
Mobile applications /
Mobile firmware & hardware
WCD9390
Mobile applications /
Mobile firmware & hardware
WCD9395
Mobile applications /
Mobile firmware & hardware
WSA8840
Mobile applications /
Mobile firmware & hardware
WSA8845
Mobile applications /
Mobile firmware & hardware
WSA8845H
Mobile applications /
Mobile firmware & hardware
Vendor: Qualcomm
Description
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Computer Vision. A local application can read and manipulate data.
Mitigation
Install security update from vendor's website.
Vulnerable software versions
FastConnect 7800: All versions
Snapdragon 8 Gen 3 Mobile Platform: All versions
WCD9390: All versions
WCD9395: All versions
WSA8840: All versions
WSA8845: All versions
WSA8845H: All versions
External links
https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
