CVE-2024-43060
Published: 03 March 2025
Summary
CVE-2024-43060 is a high-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the memory corruption flaw in sound model parameter loading from HLOS to ADSP by requiring timely application of Qualcomm's March 2025 patches.
Implements memory protections like address space randomization and data execution prevention to block exploitation of the out-of-bounds read and buffer overflow in ADSP.
Requires validation of sound model parameters during transfer from HLOS to ADSP to prevent buffer overflows and out-of-bounds reads.
NVD Description
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
Deeper analysisAI
CVE-2024-43060 is a memory corruption vulnerability that occurs during voice activation when sound model parameters are loaded from the High-Level Operating System (HLOS) to the Audio Digital Signal Processor (ADSP) in Qualcomm components. It is associated with CWE-823 (Use of Out-of-bounds Read) and CWE-119 (Buffer Overflow), carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue was published on March 3, 2025.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution or system compromise within the affected ADSP context.
Qualcomm has addressed this issue in its March 2025 security bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html, which provides details on patches and affected products for mitigation. Security practitioners should apply the recommended updates promptly to vulnerable Qualcomm platforms.
Details
- CWE(s)