CVE-2023-43549 is a high severity (8.4) stack buffer overflow flaw in Qualcomm chipset software, in the factory test mode code while it processes the TPC target power table. Qualcomm published it in its March 2024 security bulletin. The record names no fixed version, so get the fix from your device or module maker.
What's affected
The NVD record lists Qualcomm hardware and firmware, including AR8035, CSR8811. The record shows 2 hardware entries in its machine readable data, and the Qualcomm bulletin carries the authoritative chipset list. Use that list, not this page, to decide whether a product is in scope.
The record does not name a fixed version. Qualcomm bulletins describe fixes that are delivered to device makers, so the practical fix for you is a firmware or operating system update from whoever made the device, phone, module or vehicle unit.
NVD scores the flaw 8.4 (High). The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms the attack is made locally, from code or a user already on the device, attack complexity is low, it needs no privileges, and it needs no user interaction. Impact on confidentiality is high, on integrity high and on availability high.
We could not load the Qualcomm bulletin text when preparing this page, because the site renders its tables with scripts. Qualcomm's own severity rating and patch details should be read on the bulletin itself. If it differs from the NVD score above, trust the bulletin for Qualcomm's view and use the NVD score for comparison across CVEs.
The weakness is tagged CWE-121, CWE-787.
How to check if you're exposed
For an Android device you control, the security patch level is a quick first signal:
adb shell getprop ro.build.version.security_patch
Compare that date with your device maker's own security bulletin for the same month. Do not assume a patch level covers this CVE until the maker's bulletin lists it. For routers, modules, telematics units, vehicles and other embedded hardware, there is usually no package manager to query. Ask the supplier which Qualcomm chipset the product uses and whether the March 2024 Qualcomm fixes are included in the firmware you run.
What to do now
- Read the Qualcomm bulletin linked in Sources and find this CVE in its table. Confirm the chipsets and the severity Qualcomm assigns.
- List the phones, modules, gateways and embedded devices in your estate that use Qualcomm silicon. Your hardware inventory or SBOM is the starting point.
- Ask each device maker whether its firmware includes the fix, and for the firmware version that does. Record the answer.
- Schedule the update. Until then, limit which apps and users can reach the affected interface, and keep untrusted apps off the device.
Why it matters
CWE-121 is stack-based buffer overflow. The overflowed buffer lives on the stack, so the spill can reach saved values such as return addresses. CWE-787 is out-of-bounds write. The code writes outside the memory it was given, which can corrupt other data or program state.
The record has only a one line description, and Qualcomm's wording is similarly brief. We will not add detail beyond what the sources say. On access, the vector says the attack does not need an account first. The base score is 8.4, rated high by NVD. Bugs of this type sit in low level firmware and driver code, which is why a fix reaches you slowly. It passes from the chip vendor to the device maker, and then to you.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and no source we could read says it is exploited in the wild.
Quick check
Is CVE-2023-43549 exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the sources we could read do not report exploitation. That can change, so check the Gold page for current status.
Who ships the fix for CVE-2023-43549?
Qualcomm supplies fixes to its customers. You get the fix through a firmware or operating system update from the maker of your device or module.
Sources
Last reviewed: 19 October 2026.
