CVE-2023-43554 is a high severity (8.4) memory safety flaw in Qualcomm chipset software, in the FastRPC code that handles an IOCTL. Qualcomm published it in its July 2024 security bulletin. The record names no fixed version, so get the fix from your device or module maker.
What's affected
The NVD record lists Qualcomm hardware and firmware, including AQT1000, FASTCONNECT 6200. The record shows 2 hardware entries in its machine readable data, and the Qualcomm bulletin carries the authoritative chipset list. Use that list, not this page, to decide whether a product is in scope.
The record does not name a fixed version. Qualcomm bulletins describe fixes that are delivered to device makers, so the practical fix for you is a firmware or operating system update from whoever made the device, phone, module or vehicle unit.
NVD scores the flaw 8.4 (High). The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms the attack is made locally, from code or a user already on the device, attack complexity is low, it needs no privileges, and it needs no user interaction. Impact on confidentiality is high, on integrity high and on availability high.
We could not load the Qualcomm bulletin text when preparing this page, because the site renders its tables with scripts. Qualcomm's own severity rating and patch details should be read on the bulletin itself. If it differs from the NVD score above, trust the bulletin for Qualcomm's view and use the NVD score for comparison across CVEs.
The weakness is tagged CWE-119, CWE-787.
How to check if you're exposed
For an Android device you control, the security patch level is a quick first signal:
adb shell getprop ro.build.version.security_patch
Compare that date with your device maker's own security bulletin for the same month. Do not assume a patch level covers this CVE until the maker's bulletin lists it. For routers, modules, telematics units, vehicles and other embedded hardware, there is usually no package manager to query. Ask the supplier which Qualcomm chipset the product uses and whether the July 2024 Qualcomm fixes are included in the firmware you run.
What to do now
- Read the Qualcomm bulletin linked in Sources and find this CVE in its table. Confirm the chipsets and the severity Qualcomm assigns.
- List the phones, modules, gateways and embedded devices in your estate that use Qualcomm silicon. Your hardware inventory or SBOM is the starting point.
- Ask each device maker whether its firmware includes the fix, and for the firmware version that does. Record the answer.
- Schedule the update. Until then, limit which apps and users can reach the affected interface, and keep untrusted apps off the device.
Why it matters
CWE-119 is improper restriction of operations within the bounds of a memory buffer. The code performs operations on a buffer without keeping them inside its bounds. It is the parent class of reads and writes outside a buffer. CWE-787 is out-of-bounds write. The code writes outside the memory it was given, which can corrupt other data or program state.
The record has only a one line description, and Qualcomm's wording is similarly brief. We will not add detail beyond what the sources say. On access, the vector says the attack does not need an account first. The base score is 8.4, rated high by NVD. Bugs of this type sit in low level firmware and driver code, which is why a fix reaches you slowly. It passes from the chip vendor to the device maker, and then to you.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and no source we could read says it is exploited in the wild.
Quick check
Is CVE-2023-43554 exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the sources we could read do not report exploitation. That can change, so check the Gold page for current status.
Who ships the fix for CVE-2023-43554?
Qualcomm supplies fixes to its customers. You get the fix through a firmware or operating system update from the maker of your device or module.
Sources
Last reviewed: 19 October 2026.
