TZ Secure OS compromise via unchecked buffer copy
Published Jun 3, 2024 · Updated Aug 2, 2024
Memory corruption in Qualcomm Snapdragon TZ Secure OS allows local users to compromise confidentiality, integrity, and availability. Tunnel Invoke Manager initialization copies input into a buffer without checking its size, corrupting TZ Secure OS memory. No privileges or user interaction are required, but local execution on a device using an affected chipset is necessary.
CVSS severity9.3
CriticalEPSS probability0.10%
Next 30 days · Sep 16, 2026Known exploitationUnconfirmed
Based on sourced intelligenceHinoki checkNot available
Coverage for this vulnerabilitySummary
What happened
Memory corruption in Qualcomm Snapdragon TZ Secure OS allows local users to compromise confidentiality, integrity, and availability. Tunnel Invoke Manager initialization copies input into a buffer without checking its size, corrupting TZ Secure OS memory. No privileges or user interaction are required, but local execution on a device using an affected chipset is necessary.
The record
- CVE
- CVE-2023-43538
- Published
- Jun 3, 2024
- Updated
- Aug 2, 2024
- Vendor
- Qualcomm
- Product
- Robotics RB3 Platform Firmware
- Classifications
- CWE-120
- Attack vector
- local
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jun 3, 2024CVE publishedPublication date reported by the CVE source.
- Aug 2, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=*
What conditions does exploitation require?
Attack vectorlocal
Required privilegesunauthenticated
What is affected?
Qualcomm · Robotics RB3 Platform Firmwareversion=*
Qualcomm · SA8155P Firmwareversion=*
Qualcomm · SA9000P Firmwareversion=*
Qualcomm · WCD9326 Firmwareversion=*
Qualcomm · SA8155 Firmwareversion=*
Qualcomm · QSM8350 Firmwareversion=*
Qualcomm · QCA6698AQ Firmwareversion=*
Qualcomm · QAM8255P Firmwareversion=*
Qualcomm · WCD9390 Firmwareversion=*
Qualcomm · Qualcomm QCA6431 Firmwareversion=*
Qualcomm · SA8540P Firmwareversion=*
Qualcomm · QDX1011 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon X24 LTE Modem Firmwareversion=*
Qualcomm · Qualcomm QCA6595AU Firmwareversion=*
Qualcomm · Qualcomm WCD9375 Firmwareversion=*
Qualcomm · QCN6274 Firmwareversion=*
Qualcomm · SA8770P Firmwareversion=*
Qualcomm · Snapdragon X50 5G Modem-RF System Firmwareversion=*
Qualcomm · Qualcomm SG8275P Firmwareversion=*
Qualcomm · Qualcomm SM8550P Firmwareversion=*
Qualcomm · WSA8810 Firmwareversion=*
Qualcomm · QCA8337 Firmwareversion=*
Qualcomm · Qualcomm QCA6426 Firmwareversion=*
Qualcomm · Qualcomm QCA6797AQ Firmwareversion=*
Qualcomm · QCA8081 Firmwareversion=*
Qualcomm · FastConnect 7800 Firmwareversion=*
Qualcomm · Qualcomm QCA6595 Firmwareversion=*
Qualcomm · SC8380XP Firmwareversion=*
Qualcomm · QAM8650P Firmwareversion=*
Qualcomm · Snapdragon X65 5G Modem-RF System Firmwareversion=*
Qualcomm · SA8775P Firmwareversion=*
Qualcomm · Snapdragonversion=AQT1000; version=AR8035; version=FastConnect 6200; version=FastConnect 6800; version=FastConnect 6900; version=FastConnect 7800; version=QAM8255P; version=QAM8295P; version=QAM8650P; version=QAM8775P; version=QCA6174A; version=QCA6310; version=QCA6335; version=QCA6391; version=QCA6420; version=QCA6421; version=QCA6426; version=QCA6430; version=QCA6431; version=QCA6436; version=QCA6564A; version=QCA6564AU; version=QCA6574; version=QCA6574A; version=QCA6574AU; version=QCA6584AU; version=QCA6595; version=QCA6595AU; version=QCA6696; version=QCA6698AQ; version=QCA6797AQ; version=QCA8081; version=QCA8337; version=QCA9377; version=QCC710; version=QCM8550; version=QCN6224; version=QCN6274; version=QCS8550; version=QDU1000; version=QDU1010; version=QDU1110; version=QDU1210; version=QDX1010; version=QDX1011; version=QFW7114; version=QFW7124; version=QRU1032; version=QRU1052; version=QRU1062; version=QSM8350; version=Robotics RB3 Platform; version=SA6145P; version=SA6155; version=SA6155P; version=SA8150P; version=SA8155; version=SA8155P; version=SA8255P; version=SA8295P; version=SA8540P; version=SA8770P; version=SA8775P; version=SA9000P; version=SC8380XP; version=SD670; version=SD675; version=SD 675; version=SD855; version=SD865 5G; version=SD 8CX; version=SD 8 Gen1 5G; version=SDX55; version=SDX57M; version=SG8275P; version=SM7250P; version=SM8550P; version=Snapdragon 670 Mobile Platform; version=Snapdragon 675 Mobile Platform; version=Snapdragon 678 Mobile Platform (SM6150-AC); version=Snapdragon 765 5G Mobile Platform (SM7250-AA); version=Snapdragon 765G 5G Mobile Platform (SM7250-AB); version=Snapdragon 768G 5G Mobile Platform (SM7250-AC); version=Snapdragon 845 Mobile Platform; version=Snapdragon 850 Mobile Compute Platform; version=Snapdragon 855+/860 Mobile Platform (SM8150-AC); version=Snapdragon 855 Mobile Platform; version=Snapdragon 865 5G Mobile Platform; version=Snapdragon 865+ 5G Mobile Platform (SM8250-AB); version=Snapdragon 870 5G Mobile Platform (SM8250-AC); version=Snapdragon 888 5G Mobile Platform; version=Snapdragon 888+ 5G Mobile Platform (SM8350-AC); version=Snapdragon 8c Compute Platform (SC8180X-AD) "Poipu Lite"; version=Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"; version=Snapdragon 8cx Compute Platform (SC8180X-AA, AB); version=Snapdragon 8cx Compute Platform (SC8180XP-AC, AF) "Poipu Pro"; version=Snapdragon 8cx Gen 2 5G Compute Platform (SC8180X-AC, AF) "Poipu Pro"; version=Snapdragon 8cx Gen 2 5G Compute Platform (SC8180XP-AA, AB); version=Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB); version=Snapdragon 8 Gen 1 Mobile Platform; version=Snapdragon 8 Gen 2 Mobile Platform; version=Snapdragon 8+ Gen 2 Mobile Platform; version=Snapdragon AR2 Gen 1 Platform; version=Snapdragon Auto 5G Modem-RF Gen 2; version=Snapdragon X24 LTE Modem; version=Snapdragon X50 5G Modem-RF System; version=Snapdragon X55 5G Modem-RF System; version=Snapdragon X65 5G Modem-RF System; version=Snapdragon X75 5G Modem-RF System; version=Snapdragon XR2 5G Platform; version=SSG2115P; version=SSG2125P; version=SXR1230P; version=SXR2130; version=SXR2230P; version=Vision Intelligence 300 Platform; version=Vision Intelligence 400 Platform; version=WCD9326; version=WCD9340; version=WCD9341; version=WCD9370; version=WCD9375; version=WCD9380; version=WCD9385; version=WCD9390; version=WCD9395; version=WCN3950; version=WCN3980; version=WCN3990; version=WSA8810; version=WSA8815; version=WSA8830; version=WSA8832; version=WSA8835; version=WSA8840; version=WSA8845; version=WSA8845H
Qualcomm · SA6155P Firmwareversion=*
Qualcomm · QRU1032 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 865 5G Mobile Platform Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 845 Mobile Platform Firmwareversion=*
Qualcomm · WSA8845H Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 8 Gen 1 Mobile Platform Firmwareversion=*
Qualcomm · SA8255P Firmwareversion=*
Qualcomm · QCA6421 Firmwareversion=*
Qualcomm · QDX1010 Firmwareversion=*
Qualcomm · Qualcomm SD855 Firmwareversion=*
Qualcomm · SA8295P Firmwareversion=*
Qualcomm · SXR1230P Firmwareversion=*
Qualcomm · Qualcomm QCA6564A Firmwareversion=*
Qualcomm · QRU1052 Firmwareversion=*
Qualcomm · FastConnect 6900 Firmwareversion=*
Qualcomm · SSG2125P Firmwareversion=*
Qualcomm · SD 8cx Firmwareversion=*
Qualcomm · QCM8550 Firmwareversion=*
Qualcomm · Qualcomm QCA9377 Firmwareversion=*
Qualcomm · QCS8550 Firmwareversion=*
Qualcomm · WCD9370 Firmwareversion=*
Qualcomm · SA8150P Firmwareversion=*
Qualcomm · QCA6420 Firmwareversion=*
Qualcomm · SSG2115P Firmwareversion=*
Qualcomm · WSA8845 Firmwareversion=*
Qualcomm · QFW7124 Firmwareversion=*
Qualcomm · SD 8 Gen1 5G Firmwareversion=*
Qualcomm · QCN6224 Firmwareversion=*
Qualcomm · Qualcomm SM7250P Firmwareversion=*
Qualcomm · Qualcomm WCD9341 Firmwareversion=*
Qualcomm · Snapdragon X55 5G Modem-RF System Firmwareversion=*
Qualcomm · Snapdragon 8 Gen 2 Mobile Platform Firmwareversion=*
Qualcomm · Qualcomm QCA6564AU Firmwareversion=*
Qualcomm · QDU1210 Firmwareversion=*
Qualcomm · WCD9395 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 855 Mobile Platform Firmwareversion=*
Qualcomm · Vision Intelligence 400 Platform Firmwareversion=*
Qualcomm · QAM8295P Firmwareversion=*
Qualcomm · Qualcomm QCA6436 Firmwareversion=*
Qualcomm · QCA6574AU Firmwareversion=*
Qualcomm · QCA6584AU Firmwareversion=*
Qualcomm · QDU1000 Firmwareversion=*
Qualcomm · Vision Intelligence 300 Platform Firmwareversion=*
Qualcomm · QCA6335 Firmwareversion=*
Qualcomm · WCD9380 Firmwareversion=*
Qualcomm · Qualcomm QCA6574A Firmwareversion=*
Qualcomm · WSA8840 Firmwareversion=*
Qualcomm · Qualcomm QCA6574 Firmwareversion=*
Qualcomm · Snapdragon Auto 5G Modem-RF Gen 2 Firmwareversion=*
Qualcomm · Qualcomm QCA6430 Firmwareversion=*
Qualcomm · QRU1062 Firmwareversion=*
Qualcomm · SXR2230P Firmwareversion=*
Qualcomm · Qualcomm Snapdragon AR2 Gen 1 Platform Firmwareversion=*
Qualcomm · Qualcomm SDX57M Firmwareversion=*
Qualcomm · SA6145P Firmwareversion=*
Qualcomm · Qualcomm WCN3990 Firmwareversion=*
Qualcomm · Qualcomm SD865 5G Firmwareversion=*
Qualcomm · FastConnect 6200 Firmwareversion=*
Qualcomm · AR8035 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 675 Mobile Platform Firmwareversion=*
Qualcomm · QCC710 Firmwareversion=*
Qualcomm · Qualcomm SD675 Firmwareversion=*
Qualcomm · SD 675 Firmwareversion=*
Qualcomm · QCA6174A Firmwareversion=*
Qualcomm · QAM8775P Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 850 Mobile Compute Platform Firmwareversion=*
Qualcomm · AQT1000 Firmwareversion=*
Qualcomm · SA6155 Firmwareversion=*
Qualcomm · Qualcomm SDX55 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 670 Mobile Platform Firmwareversion=*
Qualcomm · WCN3950 Firmwareversion=*
Qualcomm · WSA8830 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon 888+ 5G Mobile Platform Firmwareversion=*
Qualcomm · QCA6391 Firmwareversion=*
Qualcomm · Qualcomm Snapdragon XR2 5G Platform Firmwareversion=*
Qualcomm · WCD9385 Firmwareversion=*
Qualcomm · WCD9340 Firmwareversion=*
Qualcomm · WCN3980 Firmwareversion=*
Qualcomm · WSA8835 Firmwareversion=*
Qualcomm · FastConnect 6800 Firmwareversion=*
Qualcomm · WSA8832 Firmwareversion=*
Qualcomm · SXR2130 Firmwareversion=*
Qualcomm · Snapdragon X75 5G Modem-RF System Firmwareversion=*
Qualcomm · QCA6696 Firmwareversion=*
Qualcomm · QDU1110 Firmwareversion=*
Qualcomm · QFW7114 Firmwareversion=*
Qualcomm · Qualcomm SD670 Firmwareversion=*
Qualcomm · WSA8815 Firmwareversion=*
Qualcomm · QDU1010 Firmwareversion=*
Qualcomm · QCA6310 Firmwareversion=*
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Daily unique IPsNo honeypot observations are available for this CVE in the selected window.
Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesunauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed
Weakness, pattern, technique
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo