CVE-2024-49846 is a high severity (CVSS 8.2) memory corruption flaw in Qualcomm chipsets and firmware, caused when decoding over the air messages that carry the T3448 information element. Qualcomm lists it in its May 2025 security bulletin, so check which of your devices use affected parts.
What's affected
The record lists many Qualcomm products and firmware, including AR8035, FastConnect 7800, QCA6574AU and QCA6595AU. There are more in the NVD record, and the Qualcomm bulletin has the authoritative list.
The record does not name a fixed version. The bulletin page could not be retrieved in full during review, so look at it directly for per chipset detail. In practice Qualcomm fixes reach end users as firmware and software updates built by the device maker.
How to check if you're exposed
A dependency scanner will not see this. Use your mobile device management and your supplier notices.
adb shell getprop ro.build.version.security_patch
Compare the reported security patch level with the device maker bulletin for May 2025 or later. For modules and gateways you embed in products, ask the module vendor which Qualcomm part it uses and whether it has issued the update.
What to do now
- Make a list of products that embed the Qualcomm parts in the bulletin.
- Ask each supplier whether the May 2025 Qualcomm fix is included in their firmware.
- Roll out updated firmware and operating system builds.
- Include the security patch level in your mobile device compliance rules.
- Retire devices that will not get patches if they handle sensitive work.
Why it matters
The record classes the weakness as CWE-125 (Out-of-bounds Read) and CWE-126 (Buffer Over-read). Code that decodes a message element has to check its length against the buffer it is reading. When that check is missing or wrong, the decoder reads or handles memory it does not own, and memory corruption follows.
The record rates the issue as reachable over the network with no privileges. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-49846.
Quick check
Where do I find the affected chipset list?
In the Qualcomm May 2025 security bulletin, which the NVD record references.
Do I patch this myself?
Usually not. Device makers ship the update, so ask them and apply their releases.
Sources
Last reviewed: 19 October 2026.
