CVE-2023-33107
KEVQualcomm Multiple Chipsets Integer Overflow Vulnerability
Description
Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedDec 5, 2023
Last modifiedJun 17, 2026
Added to KEVDec 5, 2023
Remediation dueDec 26, 2023
References
- qualcomm.com/company/product-security/bulletins/december-2023-bulletinPatchVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107US Government Resource
0 recent articles mention this CVE
72
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1036 days
- CVSS
- 8.4 HIGH
- EPSS (30-day exploit probability)
- 0.74% · top 46% of all CVEs
- Weakness
- CWE-190
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.