CVE-2023-43555 is a high severity (8.2) buffer over-read flaw in Qualcomm chipset software, in the video component while parsing an MP2 clip with an invalid section length. Qualcomm published it in its June 2024 security bulletin. The record names no fixed version, so get the fix from your device or module maker.
What's affected
The NVD record lists Qualcomm hardware and firmware, including AQT1000, FASTCONNECT 6200. The record shows 2 hardware entries in its machine readable data, and the Qualcomm bulletin carries the authoritative chipset list. Use that list, not this page, to decide whether a product is in scope.
The record does not name a fixed version. Qualcomm bulletins describe fixes that are delivered to device makers, so the practical fix for you is a firmware or operating system update from whoever made the device, phone, module or vehicle unit.
NVD scores the flaw 8.2 (High). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. In plain terms the attack is made over the network, attack complexity is low, it needs no privileges, and it needs no user interaction. Impact on confidentiality is high, on integrity no and on availability low.
We could not load the Qualcomm bulletin text when preparing this page, because the site renders its tables with scripts. Qualcomm's own severity rating and patch details should be read on the bulletin itself. If it differs from the NVD score above, trust the bulletin for Qualcomm's view and use the NVD score for comparison across CVEs.
The weakness is tagged CWE-126, CWE-125.
How to check if you're exposed
For an Android device you control, the security patch level is a quick first signal:
adb shell getprop ro.build.version.security_patch
Compare that date with your device maker's own security bulletin for the same month. Do not assume a patch level covers this CVE until the maker's bulletin lists it. For routers, modules, telematics units, vehicles and other embedded hardware, there is usually no package manager to query. Ask the supplier which Qualcomm chipset the product uses and whether the June 2024 Qualcomm fixes are included in the firmware you run.
What to do now
- Read the Qualcomm bulletin linked in Sources and find this CVE in its table. Confirm the chipsets and the severity Qualcomm assigns.
- List the phones, modules, gateways and embedded devices in your estate that use Qualcomm silicon. Your hardware inventory or SBOM is the starting point.
- Ask each device maker whether its firmware includes the fix, and for the firmware version that does. Record the answer.
- Schedule the update. Until then, limit exposure of the affected interface to networks and peers you trust where the device allows it.
Why it matters
CWE-126 is buffer over-read. The code reads beyond the end of a buffer, so data from nearby memory can leak out. CWE-125 is out-of-bounds read. The code reads past the end of a buffer, which can expose memory that was never meant to be returned.
The record has only a one line description, and Qualcomm's wording is similarly brief. We will not add detail beyond what the sources say. On access, the vector says the attack does not need an account first. The base score is 8.2, rated high by NVD. Bugs of this type sit in low level firmware and driver code, which is why a fix reaches you slowly. It passes from the chip vendor to the device maker, and then to you.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and no source we could read says it is exploited in the wild.
Quick check
Is CVE-2023-43555 exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the sources we could read do not report exploitation. That can change, so check the Gold page for current status.
Who ships the fix for CVE-2023-43555?
Qualcomm supplies fixes to its customers. You get the fix through a firmware or operating system update from the maker of your device or module.
Sources
Last reviewed: 19 October 2026.
