CVE-2024-21466 Integer Underflow (Wrap or Wraparound) in WLAN Host Communication
An integer underflow in Qualcomm WLAN host communication allows information disclosure during IE parsing, affecting Android devices using Snapdragon chipsets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21466?
CVE-2024-21466 is a medium-severity vulnerability in Qualcomm Fastconnect 7800 Firmware, published on 1 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure while parsing sub-IE length during new IE generation.
Weakness: CWE-191
Which versions are affected by CVE-2024-21466?
It affects 64 products.
Products include Qualcomm Fastconnect 7800 Firmware, Qualcomm Immersive Home 3210 Platform Firmware, Qualcomm Immersive Home 326 Platform Firmware, Qualcomm Ipq5300 Firmware, Qualcomm Ipq5302 Firmware, Qualcomm Ipq5312 Firmware and 58 more.
How do I fix CVE-2024-21466?
Apply the vendor's patch.
Is CVE-2024-21466 being exploited?
There is no known exploitation of CVE-2024-21466 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Fastconnect 7800 Firmware
Sources
Also known as 3582487, A-318386769, GHSA-vmr3-xrh5-2r29, PUB-A-318386769.