First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-43066

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption while handling file descriptor during listener registration/de-registration.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	CSRB31024; FastConnect 6200; FastConnect 6700; FastConnect 6800; FastConnect 6900; FastConnect 7800; MDM9650; QAM8295P; QCA6310; QCA6335; QCA6391; QCA6426; QCA6436; QCA6564; QCA6564AU; QCA6574; QCA6574A; QCA6574AU; QCA6595; QCA6595AU

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.htmlVendor Advisory

Timeline

Published: Apr 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-430677.8Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.CVE-2024-43078.1SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL q CVE-2024-430777.8In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local es CVE-2024-43088.1SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL q CVE-2024-430807.8In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to CVE-2024-430817.8In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the cod CVE-2024-430825.5In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to CVE-2024-430835.5In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to CVE-2024-430845.5In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information di CVE-2024-430857.8In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to CVE-2024-430865.5In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a CVE-2024-430877.8In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in t

CVE-2024-43066: High severity, CVSS 7.8 | Vulnix