Qualcomm Windows WLAN Host Buffer Copy Without Checking Size of Input Vulnerability Allowing Memory Corruption

A buffer copy vulnerability has been identified in the Windows WLAN Host component of certain Qualcomm chipsets. This vulnerability, classified as a 'classic buffer overflow', arises from memory corruption while processing IOCTL calls invoked from user space. The issue specifically relates to the verification of non-extension FIPS encryption and decryption functionality, creating potential for memory corruption.

Impact

Exploitation of this vulnerability leads to memory corruption, which can commonly be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Qualcomm has notified customers about this vulnerability and provided patch instructions. The patch can be applied by following the instructions available in the January 2025 Qualcomm Security Bulletin.