{"id":"CVE-2023-33063","kind":"vulnerability","aliases":["CVE-2023-33063"],"related":[],"title":"Memory corruption in DSP Services during a remote call from HLOS to DSP","description":"Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have a use-after-free bug in DSP Services, where a remote call from the phone's main OS to the DSP corrupts memory. An attacker with code running on the main OS can use it to gain control of the DSP and possibly further code execution.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-12-05T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm 315 5g iot modem firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm apq8017 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm aqt1000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8031 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8035 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar9380 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm c-v2x 9150 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csr8811 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6620 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6640 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csrb31024 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn3991 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn3998 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn6750 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6390 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn685x-5 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn685x-1 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn785x-1 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm wcn785x-5 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm flight rb5 5g platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm immersive home 214 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm immersive home 216 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm immersive home 316 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm immersive home 318 platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq4018 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq4019 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq4028 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq4029 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq5010 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq6010 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq6018 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq6028 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8064 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8065 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8068 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8070 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8070a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8071a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8072a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ipq8074a firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor's security patch for the affected Qualcomm chipset as published by the device maker; discontinue use of the product if no fix is available (per CISA).","status":"open","published_at":"2023-12-05T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:46+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's security patch for the affected Qualcomm chipset as published by the device maker; discontinue use of the product if no fix is available (per CISA).","reach":"local","impact":"high","summary":"Multiple Qualcomm chipsets have a use-after-free bug in DSP Services, where a remote call from the phone's main OS to the DSP corrupts memory. An attacker with code running on the main OS can use it to gain control of the DSP and possibly further code execution.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gains code execution on the DSP and possibly escalates privileges","analyst_note":"Find the affected chipset list and patched firmware/security bulletin version from Qualcomm's security bulletin for CVE-2023-33063 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2842,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':80A,84A '-2023':15A,18A '-33063':16A,19A '-5':76A,88A '214':99A '216':105A '315':24A '316':111A '318':117A '5g':25A,93A '9150':48A 'action':253C 'android':168B 'appli':254C 'apq8017':30A 'aqt1000':33A 'ar8031':36A 'ar8035':39A 'ar9380':42A 'attack':204B 'bug':184B 'c':46A 'c-v2x':45A 'call':9A,191B,246C 'chipset':177B,228C 'chipsets':22A 'cisa':251C 'code':206B,224B 'contain':229C 'control':217B 'corrupt':2A,201B,239C 'csr8811':51A 'csra6620':54A 'csra6640':57A 'csrb31024':60A 'cve':14A,17A 'devic':173B 'discontinu':262C 'dsp':4A,13A,186B,200B,220B,241C,250C 'due':236C 'execut':225B 'exploit':169B 'firmware':28A,31A,34A,37A,40A,43A,49A,52A,55A,58A,61A,64A,67A,70A,73A,77A,81A,85A,89A,95A,101A,107A,113A,119A,122A,125A,128A,131A,134A,137A,140A,143A,146A,149A,152A,155A,158A,161A,164A,167A 'flight':91A 'free':183B,234C 'gain':216B 'hlos':11A,248C 'home':98A,104A,110A,116A 'immersive':97A,103A,109A,115A 'infrastructur':170B 'instruct':260C 'iot':26A 'ipq4018':121A 'ipq4019':124A 'ipq4028':127A 'ipq4029':130A 'ipq5010':133A 'ipq6010':136A 'ipq6018':139A 'ipq6028':142A 'ipq8064':145A 'ipq8065':148A 'ipq8068':151A 'ipq8070':154A 'ipq8070a':157A 'ipq8071a':160A 'ipq8072a':163A 'ipq8074a':166A 'main':196B,210B 'memori':1A,202B,238C 'mitig':257C,270C 'mobil':172B 'mobile-devic':171B 'modem':27A 'multipl':175B,226C 'multiple':21A 'os':197B,211B 'per':258C 'phone':194B 'platform':94A,100A,106A,112A,118A 'possibl':222B 'product':266C 'qca6390':72A 'qualcomm':20A,23A,29A,32A,35A,38A,41A,44A,50A,53A,56A,59A,62A,65A,68A,71A,74A,78A,82A,86A,90A,96A,102A,108A,114A,120A,123A,126A,129A,132A,135A,138A,141A,144A,147A,150A,153A,156A,159A,162A,165A,174B,176B,227C 'rb5':92A 'remedi':255C,268C 'remot':8A,190B,245C 'requir':252C 'run':207B 'servic':5A,187B,242C 'unavail':272C 'use':181B,213B,232C,263C 'use-after-fre':180B,231C 'v2x':47A 'vendor':259C 'vulner':235C 'wcn3991':63A 'wcn3998':66A 'wcn6750':69A 'wcn685x':75A,79A 'wcn785x':83A,87A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-05T00:00:00+00:00","kev":{"dateAdded":"2023-12-05","dueDate":"2023-12-26","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-33063","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33063","severity":null,"published_at":"2023-12-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-33063","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33063","severity":null,"published_at":"2023-12-05T03:15:12+00:00","modified_at":"2026-06-17T06:00:38+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}