CVE-2024-49843

CVE-2024-49843 is a memory corruption vulnerability stemming from improper validation of array index (CWE-129) during the processing of IOCTL calls from user space intended to handle GPU AHB bus errors. It affects Qualcomm components, as detailed in the vendor's security bulletin.

The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation requires local access with low privileges and low complexity, with no user interaction needed. A malicious local user could send a crafted IOCTL request, triggering memory corruption that enables high-impact compromise of confidentiality, integrity, and availability, such as arbitrary code execution or system crashes.

Qualcomm's February 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html outlines affected products and recommends applying vendor-provided patches for mitigation.