Secuno
ENNL
Book demo

CVE-2023-33106

Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset

8.4 HIGHActively exploited (CISA KEV)EPSS 0.79%
  1. Published5 Dec 2023
  2. Added to CISA KEV5 Dec 2023
  3. Remediation due26 Dec 2023
Actively exploited (CISA KEV)

Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Added to KEV: 5 Dec 2023Federal remediation due: 26 Dec 2023

Description

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Qualcomm Ar8035 Firmwareall versions
Qualcomm Csra6620 Firmwareall versions
Qualcomm Csra6640 Firmwareall versions
Qualcomm Fastconnect 6200 Firmwareall versions
Qualcomm Fastconnect 6700 Firmwareall versions
Qualcomm Fastconnect 6800 Firmwareall versions
Qualcomm Fastconnect 6900 Firmwareall versions
Qualcomm Fastconnect 7800 Firmwareall versions
Qualcomm Flight Rb5 5g Platform Firmwareall versions
Qualcomm Qam8255p Firmwareall versions
Qualcomm Qam8295p Firmwareall versions
Qualcomm Qam8650p Firmwareall versions
Qualcomm Qam8775p Firmwareall versions
Qualcomm Qca6174a Firmwareall versions
Qualcomm Qca6391 Firmwareall versions
Qualcomm Qca6426 Firmwareall versions
Qualcomm Qca6436 Firmwareall versions
Qualcomm Qca6574a Firmwareall versions
Qualcomm Qca6574au Firmwareall versions
Qualcomm Qca6574 Firmwareall versions
Qualcomm Qca6595au Firmwareall versions
Qualcomm Qca6595 Firmwareall versions
Qualcomm Qca6696 Firmwareall versions
Qualcomm Qca6698aq Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10910910.0
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability…
CVE-2026-962658.2
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability…
CVE-2026-1089159.9
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part…
CVE-2026-1089149.9
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown…
CVE-2026-1088939.9
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects…
CVE-2026-10889210.0
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects…

Frequently asked

Is CVE-2023-33106 being actively exploited?

Yes. CVE-2023-33106 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 5 Dec 2023.

How severe is CVE-2023-33106?

CVE-2023-33106 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 0.79% probability of exploitation.

Which products are affected by CVE-2023-33106?

Affected products include Qualcomm Ar8035 Firmware, Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Fastconnect 6200 Firmware, Qualcomm Fastconnect 6700 Firmware, and 19 more.

How do I fix CVE-2023-33106?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-33106 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.