CVE-2023-43517 is a high severity (CVSS 8.4) flaw in Qualcomm Automotive Multimedia. Improper access control in HAB leads to memory corruption. Qualcomm's February 2024 bulletin covers it. Ask your vehicle or module supplier which software release contains the fix.
What's affected
The record's product list includes the QAM8255P and QAM8295P chipsets with their firmware, and the bulletin is the reference for the full list. The bulletin page loads its content with scripts, so I could not read its text when I fetched it. The statements on this page come from the NVD record only.
The description says memory corruption occurs in Automotive Multimedia due to improper access control in HAB. The record does not expand the acronym, and I could not read the bulletin, so check it for what HAB covers.
Two weaknesses are listed: CWE-284, improper access control, and CWE-787, an out-of-bounds write. The vector is local, needs no account and no interaction, and has high impact on all three measures.
How to check if you're exposed
There is no package manager check for this one. It affects chipsets used in automotive infotainment and multimedia platforms, so the starting point is your supplier. If you build vehicle software, find the Qualcomm software release in your bill of materials and compare it with the bulletin.
If you operate fleets of vehicles or embedded units, ask each manufacturer for a statement about the February 2024 Qualcomm bulletin and the firmware release that carries the fix. Keep the answers in your asset records.
What to do now
- Read the February 2024 Qualcomm bulletin for the affected chipsets.
- Ask your vehicle or module supplier for the software release that carries the fix.
- If you integrate Qualcomm platforms, request the patched release from Qualcomm channels.
- Keep access to head unit software update paths limited to authenticated, signed updates.
- Record each unit's software version in your inventory.
- Plan updates for fleet vehicles through the manufacturer's normal service process.
Why it matters
Access control exists to stop one component from reaching memory or functions that belong to another. When a layer that sits between components gets it wrong, a caller can write where it should not. The record shows improper access control and an out-of-bounds write together, which fits that picture, though it does not describe the mechanics.
The vector is local with no account or interaction, and the impact is high. For vehicles, the practical risk depends on what software an attacker could run on the multimedia side, and the record says nothing about that. Treat it as a supplier patch item. The KEV flag is false.
Quick check
Can fleet owners fix this themselves?
Usually not. Fixes arrive as software updates from the vehicle or module maker, so ask the supplier for their statement and release.
Sources
Last reviewed: 19 October 2026.
