CVE-2023-33106

Qualcomm, Inc. Snapdragon, qualcomm ar8035_firmware, qualcomm csra6620_firmware

Published 5 Dec 2023 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 5 Dec 2023, with a remediation deadline of 26 Dec 2023 for US federal agencies.

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Description

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

References

www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33106 · US Government Resource