CVE-2023-43514 is a high severity (CVSS 8.4) use-after-free in Qualcomm software. Memory corruption can occur while invoking IOCTL calls from user space for internal mem MAP and internal mem UNMAP. Qualcomm's January 2024 bulletin covers it. Ask your device maker for the firmware or driver build that includes the fix.
What's affected
The record's product list includes the AR8035 and FastConnect 6200 chipsets with their firmware,, and the bulletin is the reference for the full list. The bulletin page loads its content with scripts, so I could not read its text when I fetched it. The statements on this page come from the NVD record only.
The description says the memory corruption happens while invoking IOCTL calls from user space for internal mem MAP and internal mem UNMAP. An IOCTL is a call that lets a program talk to a driver. The weakness is CWE-416, use-after-free. The vector is local, needs no account and no user interaction, and has high impact on confidentiality, integrity and availability.
The record gives no fixed version, because Qualcomm patches reach end users inside device firmware or system images. Treat the version question as a task for your device vendor.
How to check if you're exposed
There is no package to query for this. Make a list of devices that contain the Qualcomm chipsets in the bulletin, then compare each device's build with the vendor's security notes. On Android devices, the security patch level under Settings, About phone, Android version is the most useful field. On embedded and industrial devices, check the firmware version in the admin interface or the vendor's release notes.
If you build products on Qualcomm kits, check the software release your supplier gave you against the bulletin entry.
What to do now
- Read the January 2024 Qualcomm bulletin and list the chipsets that match your devices.
- Ask each device vendor for the build that includes the fix, and apply it.
- Limit which apps and services can call into driver interfaces on devices you control.
- Keep devices on a supported patch cadence, and retire models that no longer get updates.
- If you build on Qualcomm kits, request the patched software release from your supplier.
- Record each device's patch status in your asset inventory.
Why it matters
The IOCTL interface is where user space code asks the kernel or a driver to do something. If the driver frees memory and later uses it again after a map or unmap call, an attacker who controls the sequence can corrupt memory. The class is CWE-416, and the vector in the record is local, so the attacker needs code running on the device.
The 8.4 score reflects the high impact: memory corruption in a driver path can lead to code execution with elevated rights. The record does not say that, only that memory corruption occurs. The KEV flag is false and nothing in the record says the flaw is exploited. Getting the vendor patch is the response.
Quick check
Can I patch this myself?
Usually not. The fix is delivered in device firmware or system updates from the device maker, so you request and apply their update.
Sources
Last reviewed: 19 October 2026.
