Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-28586

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Medium6.0EPSS 0.14%
Published
Updated
Reserved
Assigned by
qualcomm

Description

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Timeline

  1. ID reserved

    By qualcomm

  2. · 9 months later

    Published

  3. · 12 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-28586, by who scored it
Scored byCVSSScoreVector
qualcommCNA (assigner)3.1Medium6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
NVDNVD · Modified3.1Medium6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.14% · top 97% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Weakness

Affected products

  • Qualcomm, Inc. · Snapdragon

    • affected 315 5G IoT Modem
    • affected 9205 LTE Modem
    • affected AQT1000
    • affected AR8031
    • affected AR8035
    • affected C-V2X 9150
    • affected CSR8811
    • affected CSRA6620
    • affected CSRA6640
    • affected CSRB31024
    • affected FastConnect 6200
    • affected FastConnect 6700
    • affected FastConnect 6800
    • affected FastConnect 6900
    • affected FastConnect 7800
    • affected Flight RB5 5G Platform
    • affected FSM10056
    • affected Home Hub 100 Platform
    • affected Immersive Home 3210 Platform
    • affected Immersive Home 326 Platform
    • affected IPQ5332
    • affected IPQ6000
    • affected IPQ6005
    • affected IPQ6010
    • affected IPQ6018
    • affected IPQ6028
    • affected IPQ9008
    • affected IPQ9554
    • affected IPQ9570
    • affected IPQ9574
    • affected MDM9205S
    • affected MDM9250
    • affected MDM9628
    • affected MDM9640
    • affected MDM9650
    • affected MSM8108
    • affected MSM8209
    • affected MSM8608
    • affected MSM8996AU
    • affected QAM8255P
    • and 273 more

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-28586 badge
[![CVE-2023-28586](https://trackcve.app/badge/CVE-2023-28586.svg)](https://trackcve.app/cve/CVE-2023-28586)

Record last updated .