CVE-2024-53023
Published: 03 March 2025
Summary
CVE-2024-53023 is a high-severity Use After Free (CWE-416) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-53023 is a memory corruption vulnerability stemming from a use-after-free error (CWE-416) that can occur while accessing a variable during extended back-to-back tests. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects components in Qualcomm products, as documented in their security advisories.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables high-impact disruption to confidentiality, integrity, and availability through memory corruption, potentially allowing arbitrary code execution or system compromise within the affected scope.
Qualcomm's March 2025 security bulletin provides details on the vulnerability, including affected products and recommended patches or mitigations, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5799
Vulnerability details
Memory corruption may occur while accessing a variable during extended back to back tests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free memory corruption in Qualcomm components directly enables arbitrary code execution from low privileges, mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free memory corruption vulnerability by identifying, prioritizing, and applying patches from Qualcomm's security bulletin.
Implements memory safeguards like ASLR, DEP, and canaries to protect against exploitation of the use-after-free error during variable access.
Ensures receipt, dissemination, and implementation of vendor security advisories such as Qualcomm's March 2025 bulletin documenting this CVE and its patches.