Qualcomm Patches Exploited DSP Zero-Day and Critical WLAN Memory Corruption Flaw
Active Exploitation · 2 sources · Updated 3mo ago · First seen Oct 9, 2024
Qualcomm released security updates for October 2024 to address 20 vulnerabilities across its products, including an actively exploited zero-day and a critical memory-corruption issue. The zero-day, CVE-2024-43047, affects the Qualcomm Digital Signal Processor (DSP) service used by multiple chipsets and stems from a use-after-free condition that could let a local low-privileged attacker trigger memory corruption on vulnerable devices.
Qualcomm also fixed CVE-2024-33066, a critical input-validation flaw in the WLAN Resource Manager that can likewise lead to memory corruption. The company said customers should deploy updated firmware for affected chipsets as soon as possible, including updates related to the FASTRPC driver, as part of the broader bulletin covering all 20 patched issues.
