Secuno
ENNL
Book demo

CVE-2023-33063

Qualcomm Multiple Chipsets Use-After-Free

7.8 HIGHActively exploited (CISA KEV)EPSS 0.67%
  1. Published5 Dec 2023
  2. Added to CISA KEV5 Dec 2023
  3. Remediation due26 Dec 2023
Actively exploited (CISA KEV)

Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.

Added to KEV: 5 Dec 2023Federal remediation due: 26 Dec 2023

Description

Memory corruption in DSP Services during a remote call from HLOS to DSP.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Qualcomm 315 5g IoT Modem Firmwareall versions
Qualcomm 8098 Firmwareall versions
Qualcomm 8953pro Firmwareall versions
Qualcomm 8998 Firmwareall versions
Qualcomm Apq5053-aa Firmwareall versions
Qualcomm Apq8009 Firmwareall versions
Qualcomm Apq8017 Firmwareall versions
Qualcomm Apq8053-aa Firmwareall versions
Qualcomm Apq8053-ac Firmwareall versions
Qualcomm Aqt1000 Firmwareall versions
Qualcomm Ar8031 Firmwareall versions
Qualcomm Ar8035 Firmwareall versions
Qualcomm Ar9380 Firmwareall versions
Qualcomm Csr8811 Firmwareall versions
Qualcomm Csra6620 Firmwareall versions
Qualcomm Csra6640 Firmwareall versions
Qualcomm Csrb31024 Firmwareall versions
Qualcomm C-v2x 9150 Firmwareall versions
Qualcomm Flight Rb5 5g Platform Firmwareall versions
Qualcomm Immersive Home 214 Platform Firmwareall versions
Qualcomm Immersive Home 216 Platform Firmwareall versions
Qualcomm Immersive Home 316 Platform Firmwareall versions
Qualcomm Immersive Home 318 Platform Firmwareall versions
Qualcomm Ipq4018 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-859658.0
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7…
CVE-2026-57599.8
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of…
CVE-2026-1071838.1
llama.cpp before b11393 contains a use-after-free and double free vulnerability in…
CVE-2026-553309.8
In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible…
CVE-2026-1064238.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote…
CVE-2026-1064218.8
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker…

Frequently asked

Is CVE-2023-33063 being actively exploited?

Yes. CVE-2023-33063 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 5 Dec 2023.

How severe is CVE-2023-33063?

CVE-2023-33063 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 0.67% probability of exploitation.

Which products are affected by CVE-2023-33063?

Affected products include Qualcomm 315 5g IoT Modem Firmware, Qualcomm 8098 Firmware, Qualcomm 8953pro Firmware, Qualcomm 8998 Firmware, Qualcomm Apq5053-aa Firmware, and 19 more.

How do I fix CVE-2023-33063?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-33063 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.