CVE-2024-21475

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-823 CWE-119

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	315 5G IoT Modem; AQT1000; AR8031; AR8035; C-V2X 9150; CSRA6620; CSRA6640; FastConnect 6200; FastConnect 6700; FastConnect 6800; FastConnect 6900; FastConnect 7800; Flight RB5 5G Platform; FSM10055; FSM10056; FSM20055; FSM20056; MDM9628; QAM8255P; QAM8295P
qualcomm	snapdragon	*

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2024-bulletin.htmlPatch, Vendor Advisory
https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2024-bulletin.htmlPatch, Vendor Advisory

Timeline

Published: May 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-214767.8Memory corruption when the channel ID passed by user is not validated and further used.CVE-2024-214777.5Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.CVE-2024-214785.5transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.CVE-2024-214797.5Transient DOS during music playback of ALAC content.CVE-2024-21488.8A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of CVE-2024-214809.8Memory corruption while playing audio file having large-sized input buffer.CVE-2024-214818.4Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.CVE-2024-214827.8Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs imag CVE-2024-214834.6A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufacture CVE-2024-214845.9Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. CVE-2024-214855.4Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packa CVE-2024-214889.8Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function wit