CVE-2024-49839 is a high severity (CVSS 8.2) memory corruption flaw in Qualcomm chipsets and firmware, triggered during management frame processing because of a mismatch in the T2LM information element. Qualcomm addressed it in its February 2025 security bulletin, so check which devices you ship or manage.
What's affected
The record lists many Qualcomm products and their firmware, including AR8035, CSR8811, FastConnect 6700 and FastConnect 6900, plus others. Read the Qualcomm bulletin for the full set.
The record does not name a fixed version. For chipset bugs the fix usually arrives as updated firmware or drivers from the device maker. The Qualcomm bulletin page could not be retrieved in full during review, so check it directly for patch details.
If you build or manage phones, access points or embedded devices with these chipsets, the question is when your supplier will ship the update.
How to check if you're exposed
You will not find this with a package scanner. Ask your device and chipset suppliers which products use the listed Qualcomm parts and whether they have shipped the fix from the February 2025 bulletin.
On Android devices you can read the security patch level from the settings and compare it to the monthly bulletin.
adb shell getprop ro.build.version.security_patch
For routers and access points, check the vendor firmware release notes for a reference to the CVE.
What to do now
- List devices in your fleet that use Qualcomm Wi-Fi or Bluetooth chipsets named in the bulletin.
- Ask suppliers for their patch status against the February 2025 Qualcomm bulletin.
- Apply firmware and operating system updates as they appear.
- Where a device cannot be updated, keep it away from untrusted wireless environments.
- Track the update in your asset records so you can show it was done.
Why it matters
The record classes the weakness as CWE-125 (Out-of-bounds Read) and CWE-126 (Buffer Over-read), both memory read problems, where code reads past the end of a buffer. The description speaks of memory corruption while handling a management frame with a mismatched T2LM element.
The record rates the issue as reachable over the network with no privileges. It does not flag exploitation, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-49839.
Quick check
Is there a fix I can install now?
Check your device maker. The fix reaches devices through firmware or system updates after Qualcomm publishes its bulletin.
Sources
Last reviewed: 19 October 2026.
