PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-43047 Qualcomm CVE debrief

CVE-2024-43047 is a Qualcomm multiple-chipsets use-after-free vulnerability that CISA added to the Known Exploited Vulnerabilities (KEV) catalog on 2024-10-08. Public detail in the supplied corpus is limited, but the KEV listing indicates active exploitation concern and directs organizations to apply vendor remediations or mitigations, or discontinue use if remediation is unavailable.

Vendor
Qualcomm
Product
Multiple Chipsets
CVSS
HIGH 7.8
CISA KEV
Listed
Original CVE published
2024-10-08
Original CVE updated
2024-10-08
Advisory published
2024-10-08
Advisory updated
2024-10-08

Who should care

Security teams, OEMs, device fleet operators, and administrators responsible for Qualcomm-based hardware or downstream products that incorporate Qualcomm chipsets should prioritize this issue.

Technical summary

The available source corpus identifies CVE-2024-43047 as a use-after-free vulnerability affecting multiple Qualcomm chipsets. CISA’s KEV entry places the issue on the federal exploitation watchlist as of 2024-10-08 and recommends following vendor remediation or mitigation guidance. No further technical exploit details are provided in the supplied sources.

Defensive priority

High / urgent. KEV inclusion means this vulnerability should be treated as actively exploited or of immediate exploitation concern, with remediation prioritized ahead of routine patch cycles.

Recommended defensive actions

  • Check whether any in-scope devices, appliances, or embedded systems use affected Qualcomm chipsets.
  • Apply vendor-provided remediations or mitigations as soon as they are available.
  • If remediation or mitigation is unavailable, follow CISA guidance to discontinue use of the affected product.
  • Track downstream vendor advisories for products that embed Qualcomm components.
  • Validate exposure across device inventories, including managed endpoints, network devices, and embedded platforms.
  • Confirm remediation status before the CISA KEV due date of 2024-10-29 where applicable.

Evidence notes

The supplied corpus provides only a high-level vulnerability description, a Qualcomm multiple-chipsets attribution, and the CISA KEV entry. It does not include CVSS data, specific affected chipset models, attack prerequisites, or impact details. All statements here are limited to the official CVE/CISA records and the supplied metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-43047 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-43047

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-43047 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-43047

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.