CVE-2023-33107highunder attackCWE-190

CVE-2023-33107: high-severity vulnerability in Qualcomm, Inc. Snapdragon

Integer Overflow or Wraparound in Graphics Linux

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.4epss 0.7%
from disclosure to weapon793 days
Published on NVDDec 5
1st PoC+793d
CISA KEVDec 5
exploitation probability
0.7%top 46% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Action required by CISAfederal deadline: 2023-12-26

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

In short

A flaw in Graphics Linux allows memory corruption when a program makes certain system calls to assign shared memory regions. An attacker could exploit this to crash the system or potentially run malicious code.

Technical detail

Integer overflow vulnerability in Graphics Linux IOCTL handler during shared virtual memory region assignment, allowing attackers to trigger out-of-bounds memory access. Requires local access and execution of crafted IOCTL call; impacts memory integrity and system stability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Qualcomm, Inc. · Snapdragon
public PoCs found — 1
vulncheckvulncheck.com/xdb/5ac130590717unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Qualcomm, Inc. Snapdragon

In the same product, most dangerous first.

CVE-2026-21385HIGHInteger Overflow or Wraparound in GraphicsEPSS 1.3%KEVCVE-2025-27038HIGHUse After Free in GraphicsEPSS 1.0%KEVCVE-2025-21479HIGHIncorrect Authorization in GraphicsEPSS 0.8%KEVCVE-2023-33106HIGHUse of Out-of-range Pointer Offset in GraphicsEPSS 0.8%KEVCVE-2023-33063HIGHUse After Free in DSP ServicesEPSS 0.7%KEVCVE-2024-43047HIGHUse After Free in DSP ServiceEPSS 0.7%KEV
References
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin