Skip to content
Fencer Vulns
high 7.8

CVE-2023-33063 kev in the critical feed json

Use After Free in DSP Services

published 2023-12-05 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-37252

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2023-12-05
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Patch / fix

cisa required action Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Timeline

  1. 0-day patched (Project Zero)
  2. Added to CISA KEV
  3. Published
  4. CISA SSVC: exploitation active
  5. CISA patch deadline

Known exploited

Added
2 y ago
Patch by
2023-12-26 (2 y ago)
Ransomware
Not known
Required action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Vendor, product
Qualcomm, Multiple Chipsets
CISA name
Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched
2023-12-04
Details
project zero tracker

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Qualcomm, Inc. Snapdragon
  • qualcomm 315_5g_iot_modem_firmware
  • qualcomm apq8017_firmware
  • qualcomm aqt1000_firmware
  • qualcomm ar8031_firmware
  • qualcomm ar8035_firmware
  • qualcomm ar9380_firmware
  • qualcomm c-v2x_9150_firmware
  • qualcomm csr8811_firmware
  • qualcomm csra6620_firmware
  • qualcomm csra6640_firmware
  • qualcomm csrb31024_firmware
  • qualcomm fastconnect_6200_firmware
  • qualcomm fastconnect_6700_firmware
  • qualcomm fastconnect_6800_firmware
  • qualcomm fastconnect_6900_firmware
  • qualcomm fastconnect_7800_firmware
  • qualcomm flight_rb5_5g_platform_firmware
  • qualcomm immersive_home_214_platform_firmware
  • qualcomm immersive_home_216_platform_firmware
  • qualcomm immersive_home_316_platform_firmware
  • qualcomm immersive_home_318_platform_firmware
  • qualcomm ipq4018_firmware
  • qualcomm ipq4019_firmware
  • qualcomm ipq4028_firmware
  • qualcomm ipq4029_firmware
  • qualcomm ipq5010_firmware
  • qualcomm ipq6010_firmware
  • qualcomm ipq6018_firmware
  • qualcomm ipq6028_firmware
  • qualcomm ipq8064_firmware
  • qualcomm ipq8065_firmware
  • qualcomm ipq8068_firmware
  • qualcomm ipq8070_firmware
  • qualcomm ipq8070a_firmware
  • qualcomm ipq8071a_firmware
  • qualcomm ipq8072a_firmware
  • qualcomm ipq8074a_firmware
  • qualcomm ipq8076_firmware
  • qualcomm ipq8076a_firmware
  • qualcomm ipq8078_firmware
  • qualcomm ipq8078a_firmware
  • qualcomm ipq8173_firmware
  • qualcomm ipq8174_firmware
  • qualcomm mdm9650_firmware
  • qualcomm qam8255p_firmware
  • qualcomm qam8295p_firmware
  • qualcomm qam8650p_firmware
  • qualcomm qam8775p_firmware
  • qualcomm qca4024_firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.