CVE-2024-38410
HIGHCVSS 7.8/10EPSS 0.10%
Last modified
CVE-2024-38410 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.. EPSS estimates a 0.10% chance of exploitation in the next 30 days.
Description
Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Wsa8845h Firmware | All versions |
| Qualcomm | Wsa8845 Firmware | All versions |
| Qualcomm | Wsa8840 Firmware | All versions |
| Qualcomm | Wsa8835 Firmware | All versions |
| Qualcomm | Wsa8830 Firmware | All versions |
| Qualcomm | Wcn3660b Firmware | All versions |
| Qualcomm | Wcn3620 Firmware | All versions |
| Qualcomm | Wcd9385 Firmware | All versions |
| Qualcomm | Wcd9380 Firmware | All versions |
| Qualcomm | Wcd9375 Firmware | All versions |
| Qualcomm | Wcd9370 Firmware | All versions |
| Qualcomm | Snapdragon 8cx Gen 3 Compute Platform Firmware | All versions |
| Qualcomm | Snapdragon 429 Mobile Platform Firmware | All versions |
| Qualcomm | Sdm429w Firmware | All versions |
| Qualcomm | Sc8380xp Firmware | All versions |
| Qualcomm | Video Collaboration Vc3 Platform Firmware | All versions |
| Qualcomm | Qcs6490 Firmware | All versions |
| Qualcomm | Qcs5430 Firmware | All versions |
| Qualcomm | Qcm6490 Firmware | All versions |
| Qualcomm | Qcm5430 Firmware | All versions |
| Qualcomm | Qcc2076 Firmware | All versions |
| Qualcomm | Qcc2073 Firmware | All versions |
| Qualcomm | Fastconnect 7800 Firmware | All versions |
| Qualcomm | Fastconnect 6900 Firmware | All versions |
| Qualcomm | Fastconnect 6700 Firmware | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-38410?
Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
How severe is CVE-2024-38410?
CVE-2024-38410 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.10% probability of exploitation in the next 30 days.
How do I fix CVE-2024-38410?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-38405Transient DOS while processing the CU information from RNR I…6.5
- CVE-2024-38406Memory corruption while handling IOCTL calls in JPEG Encoder…7
- CVE-2024-38407Memory corruption while processing input parameters for any …7
- CVE-2024-38408Cryptographic issue when a controller receives an LMP start …9.1
- CVE-2024-38409Memory corruption while station LL statistic handling.7.8
- CVE-2024-3841Insufficient data validation in Browser Switcher in Google C…6.1
- CVE-2024-38411Memory corruption while registering a buffer from user-space…7.8
- CVE-2024-38412Memory corruption while invoking IOCTL calls from user-space…7.8
- CVE-2024-38413Memory corruption while processing frame packets.7.8
- CVE-2024-38414Information disclosure while processing information on firmw…5.5
- CVE-2024-38415Memory corruption while handling session errors from firmwar…7.8
- CVE-2024-38416Information disclosure during audio playback.5.5
Are you affected by CVE-2024-38410?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST