CVE-2024-43047: Qualcomm chipset firmware use-after-free in HLOS memory map handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a high-severity memory corruption flaw with confirmed exploitation per CISA KEV, though it requires local access and low privileges.

What it is

A use-after-free (CWE-416) in Qualcomm chipset firmware occurs while maintaining memory maps of HLOS memory, leading to memory corruption. It affects a broad set of FastConnect, QCA, QCS and video collaboration platform firmware products. Because it is listed in CISA KEV, it is treated as exploited in the wild.

Impact

An attacker who can trigger the flaw gains high impact to confidentiality, integrity and availability, potentially achieving code execution or memory corruption within the affected firmware context.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker needs local access to the device or a position that can reach the affected firmware interface. No remote vector is described in the record.

Exploitation

CVE-2024-43047 was added to CISA KEV on 2024-10-08, indicating known exploitation, while EPSS is low at roughly 0.67 percent (50th percentile). No ransomware campaign use is documented.

What to do

• Apply the Qualcomm October 2024 security bulletin patches for all listed FastConnect, QCA, QCS and video collaboration platform firmware.
• If patching is not possible, follow vendor mitigations or discontinue use of affected products per CISA KEV guidance.
• Restrict local access and privilege escalation paths on devices using the affected chipsets.
• Track the CISA KEV remediation due date of 2024-10-29 and verify completion.
• Inventory devices and modules containing the listed Qualcomm firmware to confirm coverage.

Detection

• Monitor for crashes or abnormal memory corruption events in firmware or kernel logs on affected Qualcomm-based devices.
• Hunt for local privilege escalation attempts or unusual processes interacting with chipset firmware interfaces.
• Correlate device telemetry with known exploitation indicators for CVE-2024-43047 from vendor and CISA advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.