CVE-2023-33106Use of Out-of-range Pointer Offset in Graphics
- 8.4HighCVSS base score
- 0.79%Exploitation in 30 daysEPSS · top 43% of all CVEs
- YesKnown exploitedin CISA's KEV since 5 Dec 2023
- YesPublic exploitsa reference or SSVC says so
Description
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability.
- Added
- 5 Dec 2023
- Fix due (US federal)
- 26 Dec 2023
- Used by ransomware
- Not known
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 5 Dec 2023.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.
Timeline
ID reserved
By qualcomm
- 7 months later
· 7 months later
Published
Added to CISA KEV
Known exploited in the wild
- 23 months later
· 23 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| qualcommCNA (assigner) | 3.1 | High8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.79% · top 43% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Affected products
- affected AR8035
- affected CSRA6620
- affected CSRA6640
- affected FastConnect 6200
- affected FastConnect 6700
- affected FastConnect 6800
- affected FastConnect 6900
- affected FastConnect 7800
- affected Flight RB5 5G Platform
- affected QAM8255P
- affected QAM8295P
- affected QAM8650P
- affected QAM8775P
- affected QCA6174A
- affected QCA6391
- affected QCA6426
- affected QCA6436
- affected QCA6574
- affected QCA6574A
- affected QCA6574AU
- affected QCA6595
- affected QCA6595AU
- affected QCA6696
- affected QCA6698AQ
- affected QCA6797AQ
- affected QCA8081
- affected QCA8337
- affected QCA9377
- affected QCM2290
- affected QCM4290
- affected QCM4325
- affected QCM4490
- affected QCM5430
- affected QCM6490
- affected QCM8550
- affected QCN6024
- affected QCN9011
- affected QCN9012
- affected QCN9024
- affected QCS2290
- and 113 more
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2023-37295 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-33106)Record last updated .