CVE-2023-33063: Qualcomm DSP Services use-after-free memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a high-severity (CVSS 7.8) use-after-free in widely deployed Qualcomm firmware and is listed in CISA KEV as exploited, though it requires local low-privileged access and EPSS is low.

What it is

CVE-2023-33063 is a use-after-free memory corruption flaw in Qualcomm DSP Services, triggered during a remote call from the high-level operating system (HLOS) to the DSP. It affects firmware for a long list of Qualcomm chipsets spanning IoT modems, Wi-Fi/Bluetooth combo parts, automotive C-V2X and the Flight RB5 5G platform. Successful corruption of DSP memory can undermine the isolation boundary between HLOS and DSP, which matters because that boundary is a core security control on these SoCs.

Impact

An attacker who can make the crafted HLOS-to-DSP call gains code execution or memory corruption within DSP Services, with high impact to confidentiality, integrity and availability of the affected subsystem. Because the flaw crosses the HLOS/DSP boundary, compromise can extend beyond a single application context.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker needs an existing foothold or local execution context on the device to issue the malicious remote call to the DSP. No network reachability or user action is implied by the record.

Exploitation

CVE-2023-33063 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of 2023-12-26, indicating exploitation in the wild; EPSS is low (0.007, ~51st percentile) and no ransomware campaign use is documented. The reference set contains only vendor patch/advisory and US government catalog links, with no public exploit write-up.

What to do

• Apply the Qualcomm December 2023 security bulletin firmware/software updates for every affected chipset listed in the record; treat this as the primary fix.
• If a device cannot be updated, follow CISA's required action and discontinue use of the affected product or isolate it from untrusted local code paths.
• Restrict local execution and debug access on affected devices so untrusted code cannot reach the HLOS-to-DSP call interface.
• Track affected firmware versions against the vendor bulletin and verify update deployment across the full product list, including IoT modem, Wi-Fi and automotive parts.
• Monitor vendor advisories for revised patches or additional affected products, since the bulletin covers multiple chipsets.

Detection

• Monitor for crashes or abnormal resets in DSP Services and related DSP subsystems on affected devices, which can indicate memory corruption attempts.
• Audit and alert on unexpected or unusual HLOS-to-DSP remote calls, especially from low-privileged processes.
• Correlate device telemetry for repeated DSP service faults with local process activity to identify exploitation attempts.
• Check asset inventory against the affected Qualcomm chipset list and confirm patch status per device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.