CVE-2024-23386

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

memory corruption when WiFi display APIs are invoked with large random inputs.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	FastConnect 6900; FastConnect 7800; SDM429W; Snapdragon 429 Mobile Platform; Snapdragon 8 Gen 1 Mobile Platform; WCD9380; WCN3620; WCN3660B; WSA8830; WSA8835
qualcomm	fastconnect_6900_firmware	<= *
qualcomm	fastconnect_7800_firmware	<= *
qualcomm	sdm429w_firmware	<= *
qualcomm	snapdragon_429_mobile_platform_firmware	<= *
qualcomm	snapdragon_8_gen_1_mobile_platform_firmware	<= *
qualcomm	wcd9380_firmware	<= *
qualcomm	wcn3620_firmware	<= *
qualcomm	wcn3660b_firmware	<= *
qualcomm	wsa8830_firmware	<= *
qualcomm	wsa8835_firmware	<= *

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.htmlPatch, Vendor Advisory

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-233874.8FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacke CVE-2024-233886.1Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker CVE-2024-23398.8PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a maskin CVE-2024-23405.3The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-cont CVE-2024-23416.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the k CVE-2024-23428.8The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the c CVE-2024-23436.4The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up CVE-2024-234397.1Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability by triggering the 0x22201B, 0x22201F, 0x222023, 0x222027 ,0x CVE-2024-23447.2The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to i CVE-2024-234407.1Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows t CVE-2024-234415.5Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.CVE-2024-234426.1An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously