---
id: "CVE-2023-33063"
kind: "vulnerability"
aliases: ["CVE-2023-33063"]
title: "Memory corruption in DSP Services during a remote call from HLOS to DSP"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Qualcomm Multiple Chipsets", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm 315 5g iot modem firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm apq8017 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm aqt1000 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ar8031 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ar8035 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ar9380 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm c-v2x 9150 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm csr8811 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm csra6620 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm csra6640 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm csrb31024 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn3991 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn3998 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn6750 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm qca6390 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn685x-5 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn685x-1 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn785x-1 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm wcn785x-5 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm flight rb5 5g platform firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm immersive home 214 platform firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm immersive home 216 platform firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm immersive home 316 platform firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm immersive home 318 platform firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq4018 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq4019 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq4028 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq4029 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq5010 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq6010 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq6018 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq6028 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8064 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8065 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8068 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8070 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8070a firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8071a firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8072a firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qualcomm ipq8074a firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "exploited", "infrastructure", "mobile-devices", "qualcomm"]
not_affected_if: ["unknown"]
published_at: "2023-12-05T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33063", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33063", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Memory corruption in DSP Services during a remote call from HLOS to DSP

Multiple Qualcomm chipsets have a use-after-free bug in DSP Services, where a remote call from the phone's main OS to the DSP corrupts memory. An attacker with code running on the main OS can use it to gain control of the DSP and possibly further code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Qualcomm Multiple Chipsets affected ? fixed ?
- vendor:qualcomm 315 5g iot modem firmware affected ? fixed ?
- vendor:qualcomm apq8017 firmware affected ? fixed ?
- vendor:qualcomm aqt1000 firmware affected ? fixed ?
- vendor:qualcomm ar8031 firmware affected ? fixed ?
- vendor:qualcomm ar8035 firmware affected ? fixed ?
- vendor:qualcomm ar9380 firmware affected ? fixed ?
- vendor:qualcomm c-v2x 9150 firmware affected ? fixed ?
- vendor:qualcomm csr8811 firmware affected ? fixed ?
- vendor:qualcomm csra6620 firmware affected ? fixed ?
- vendor:qualcomm csra6640 firmware affected ? fixed ?
- vendor:qualcomm csrb31024 firmware affected ? fixed ?
- vendor:qualcomm wcn3991 firmware affected ? fixed ?
- vendor:qualcomm wcn3998 firmware affected ? fixed ?
- vendor:qualcomm wcn6750 firmware affected ? fixed ?
- vendor:qualcomm qca6390 firmware affected ? fixed ?
- vendor:qualcomm wcn685x-5 firmware affected ? fixed ?
- vendor:qualcomm wcn685x-1 firmware affected ? fixed ?
- vendor:qualcomm wcn785x-1 firmware affected ? fixed ?
- vendor:qualcomm wcn785x-5 firmware affected ? fixed ?
- vendor:qualcomm flight rb5 5g platform firmware affected ? fixed ?
- vendor:qualcomm immersive home 214 platform firmware affected ? fixed ?
- vendor:qualcomm immersive home 216 platform firmware affected ? fixed ?
- vendor:qualcomm immersive home 316 platform firmware affected ? fixed ?
- vendor:qualcomm immersive home 318 platform firmware affected ? fixed ?
- vendor:qualcomm ipq4018 firmware affected ? fixed ?
- vendor:qualcomm ipq4019 firmware affected ? fixed ?
- vendor:qualcomm ipq4028 firmware affected ? fixed ?
- vendor:qualcomm ipq4029 firmware affected ? fixed ?
- vendor:qualcomm ipq5010 firmware affected ? fixed ?
- vendor:qualcomm ipq6010 firmware affected ? fixed ?
- vendor:qualcomm ipq6018 firmware affected ? fixed ?
- vendor:qualcomm ipq6028 firmware affected ? fixed ?
- vendor:qualcomm ipq8064 firmware affected ? fixed ?
- vendor:qualcomm ipq8065 firmware affected ? fixed ?
- vendor:qualcomm ipq8068 firmware affected ? fixed ?
- vendor:qualcomm ipq8070 firmware affected ? fixed ?
- vendor:qualcomm ipq8070a firmware affected ? fixed ?
- vendor:qualcomm ipq8071a firmware affected ? fixed ?
- vendor:qualcomm ipq8072a firmware affected ? fixed ?
- vendor:qualcomm ipq8074a firmware affected ? fixed ?

## Fix

Apply the vendor's security patch for the affected Qualcomm chipset as published by the device maker; discontinue use of the product if no fix is available (per CISA).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33063
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-33063

## From the sources

Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.

CISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_