Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-33063

Use After Free in DSP Services

High7.8Known exploitedPublic exploitEPSS 0.67%
Published
Updated
Reserved
Assigned by
qualcomm

Description

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Qualcomm Multiple Chipsets Use-After-Free Vulnerability.

Added
5 Dec 2023
Fix due (US federal)
26 Dec 2023
Used by ransomware
Not known

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.

Timeline

  1. ID reserved

    By qualcomm

  2. · 7 months later

    Published

  3. Added to CISA KEV

    Known exploited in the wild

  4. · 23 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-33063, by who scored it
Scored byCVSSScoreVector
qualcommCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.67% · top 48% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

Affected products

  • Qualcomm, Inc. · Snapdragon

    • affected 315 5G IoT Modem
    • affected APQ8017
    • affected AQT1000
    • affected AR8031
    • affected AR8035
    • affected AR9380
    • affected C-V2X 9150
    • affected CSR8811
    • affected CSRA6620
    • affected CSRA6640
    • affected CSRB31024
    • affected FastConnect 6200
    • affected FastConnect 6700
    • affected FastConnect 6800
    • affected FastConnect 6900
    • affected FastConnect 7800
    • affected Flight RB5 5G Platform
    • affected Immersive Home 214 Platform
    • affected Immersive Home 216 Platform
    • affected Immersive Home 316 Platform
    • affected Immersive Home 318 Platform
    • affected IPQ4018
    • affected IPQ4019
    • affected IPQ4028
    • affected IPQ4029
    • affected IPQ5010
    • affected IPQ6010
    • affected IPQ6018
    • affected IPQ6028
    • affected IPQ8064
    • affected IPQ8065
    • affected IPQ8068
    • affected IPQ8070
    • affected IPQ8070A
    • affected IPQ8071A
    • affected IPQ8072A
    • affected IPQ8074A
    • affected IPQ8076
    • affected IPQ8076A
    • affected IPQ8078
    • and 241 more

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-33063 badge
[![CVE-2023-33063](https://trackcve.app/badge/CVE-2023-33063.svg)](https://trackcve.app/cve/CVE-2023-33063)

Record last updated .