CVE-2024-45563 is a medium-severity vulnerability classified under CWE-787 (Out-of-bounds Write) affecting multiple Qualcomm Snapdragon platforms and related components. The flaw arises from improper handling of schedule requests within the Camera Request Manager (CRM) subsystem, specifically due to an invalid link count in the corresponding session. This memory corruption vulnerability can lead to an out-of-bounds write, potentially allowing an attacker with limited privileges (local access with low privileges) to cause partial compromise of confidentiality, limited integrity impact, and some availability degradation. The affected products include a broad range of Snapdragon mobile platforms (e.g., Snapdragon 8 Gen 1, Snapdragon 429 Mobile Platform), FastConnect wireless connectivity modules (6900, 7800), and various wireless chipsets (WCD9380, WCN3620, WSA8830 series). The CVSS 3.1 base score is 6.6, reflecting medium severity with attack vector local, low attack complexity, requiring privileges but no user interaction, and unchanged scope. Although no known exploits are currently reported in the wild, the vulnerability's presence in widely deployed mobile and wireless chipsets used in smartphones, tablets, and IoT devices makes it a significant concern. Exploitation could allow attackers to corrupt memory, potentially leading to information disclosure or denial of service conditions, especially in camera-related functionalities. The lack of available patches at the time of publication increases the urgency for mitigation and monitoring.

For European organizations, the impact of CVE-2024-45563 is notable due to the widespread use of Qualcomm Snapdragon-based devices across consumer, enterprise, and industrial sectors. Mobile devices incorporating these chipsets are common among employees and critical infrastructure operators, increasing the attack surface. Confidentiality impact is high as memory corruption could lead to leakage of sensitive data processed by camera or wireless subsystems. Integrity impact is limited but could allow manipulation of camera session data or wireless communications. Availability impact is low but denial of service or device crashes could disrupt business operations, especially in sectors relying on mobile communications or IoT devices. Given the local attack vector and requirement for low privileges, attackers would likely need physical or local access, which is plausible in scenarios involving insider threats or compromised devices. The vulnerability could also be leveraged as part of multi-stage attacks targeting mobile endpoints, which are increasingly used for remote work in Europe. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially as threat actors often reverse-engineer disclosed vulnerabilities. Organizations in Europe should consider the potential for targeted attacks against high-value individuals or critical infrastructure using affected devices.

1. Monitor Qualcomm and device manufacturers for official patches or firmware updates addressing CVE-2024-45563 and apply them promptly once available. 2. Implement strict device usage policies limiting installation of untrusted applications and restricting physical access to devices with affected chipsets. 3. Employ mobile device management (MDM) solutions to enforce security configurations, monitor device integrity, and detect anomalous behavior related to camera or wireless subsystems. 4. Conduct regular security assessments and penetration tests focusing on mobile endpoints to identify potential exploitation attempts. 5. Educate users about the risks of local privilege escalation vulnerabilities and the importance of securing devices against unauthorized access. 6. For organizations deploying IoT or embedded systems with affected Qualcomm components, isolate these devices on segmented networks and monitor for unusual activity. 7. Use endpoint detection and response (EDR) tools capable of detecting memory corruption or abnormal process behavior related to camera management services. 8. Limit the exposure of sensitive data accessible via camera or wireless modules and implement encryption where feasible to reduce confidentiality risks.