CVE-2024-43060
Published: 03 March 2025
Summary
CVE-2024-43060 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-43060 is a memory corruption vulnerability that occurs during voice activation when sound model parameters are loaded from the High-Level Operating System (HLOS) to the Audio Digital Signal Processor (ADSP) in Qualcomm components. It is associated with CWE-823 (Use of Out-of-bounds Read) and CWE-119 (Buffer Overflow), carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue was published on March 3, 2025.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution or system compromise within the affected ADSP context.
Qualcomm has addressed this issue in its March 2025 security bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html, which provides details on patches and affected products for mitigation. Security practitioners should apply the recommended updates promptly to vulnerable Qualcomm platforms.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5798
Vulnerability details
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption (buffer overflow/out-of-bounds read) in Qualcomm ADSP directly enables exploitation for privilege escalation to achieve arbitrary code execution and system compromise from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the memory corruption flaw in sound model parameter loading from HLOS to ADSP by requiring timely application of Qualcomm's March 2025 patches.
Implements memory protections like address space randomization and data execution prevention to block exploitation of the out-of-bounds read and buffer overflow in ADSP.
Requires validation of sound model parameters during transfer from HLOS to ADSP to prevent buffer overflows and out-of-bounds reads.