CVE-2024-38408

CVE-2024-38408 is a critical cryptographic vulnerability affecting Qualcomm products, specifically when a controller receives an LMP start encryption command under unexpected conditions. With a CVSS score of 9.1, it presents a network-exploitable threat with low attack complexity, potentially leading to high confidentiality and integrity impacts without requiring user interaction. While no public exploit code or KEV listing exists, Google has reportedly fixed two Android zero-days used in targeted attacks, one of which is this vulnerability, indicating active exploitation. Community discussion and media coverage are minimal despite its critical nature.