Buffer Over-read in Automotive OS Platform
Priority LOW 24CWE-126Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-126 and the CVSS impact.
Summary
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00118 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon | QAM8255P; QAM8295P; QAM8620P; QAM8650P; QAM8775P; QAMSRV1H; QAMSRV1M; QCA6595; QCA6595AU; QCA6696; SA7255P; SA7775P; SA8255P; SA8295P; SA8540P; SA8620P; SA8650P; SA8770P; SA8775P; SA9000P; SRV1H; SRV1L; SRV1M | — | No fix listed | CNA |
- Snapdragon VendorQualcomm Affected QAM8255P; QAM8295P; QAM8620P; QAM8650P; QAM8775P; QAMSRV1H; QAMSRV1M; QCA6595; QCA6595AU; QCA6696; SA7255P; SA7775P; SA8255P; SA8295P; SA8540P; SA8620P; SA8650P; SA8770P; SA8775P; SA9000P; SRV1H; SRV1L; SRV1M Fixed in — No fix listed CNA
CPE configurations NVD · 46
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qam8620p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qam8620p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qam8650p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qam8650p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qam8775p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qam8775p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qam8620p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qam8620p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qam8650p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qam8650p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qam8775p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qam8775p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Show 36 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8540p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8540p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8650p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8650p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa8775p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa8775p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:srv1l_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:srv1l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8540p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8540p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8650p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8650p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa8775p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa8775p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:srv1l_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:srv1l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45559
- 2026-10-03 Alias added: GHSA-cf88-f3cc-2r22
References
More Qualcomm Qam8255p Firmware vulnerabilities
- TI-2023-16287 Integer Overflow or Wraparound in Graphics Linux KEVCVSS 3.1HIGH 8.4
- TI-2023-16286 Use of Out-of-range Pointer Offset in Graphics KEVCVSS 3.1HIGH 8.4
- TI-2026-17287 Integer Overflow or Wraparound in Graphics KEVCVSS 3.1HIGH 7.8
- TI-2023-16248 Use After Free in DSP Services KEVCVSS 3.1HIGH 7.8
- TI-2023-16255 Improper Authentication in Automotive OS CVSS 3.1HIGH 7.1
- TI-2024-30592 Improper Validation of Array Index in WLAN Host Communication CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-45559 · CVE Program
- CVE-2024-45559 · NVD
- FIRST EPSS
- GHSA-cf88-f3cc-2r22 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences