← Vulnerability feed

Vulnerability record · CVE-2023-33107 · published 5 December 2023

CVE-2023-33107: Qualcomm Graphics Linux integer overflow memory corruption

Qualcomm · 315 5g Iot Modem Firmware

CVE-2023-33107 is an integer overflow (CWE-190) in Qualcomm Graphics Linux that causes memory corruption when a shared virtual memory region is assigned during an IOCTL call. It affects a broad set of Qualcomm chipsets and modem firmware, and CISA added it to the Known Exploited Vulnerabilities catalog, so it warrants prompt remediation.

7.8 CVSS 3.1 High CISA KEV since 5 Dec 2023 EPSS 0.89% · top 42.2% CWE-190 · Integer overflow
7.8CVSS 3.1 base score
0.89%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
150Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in the CISA KEV catalog with known exploitation and high CVSS impact, though it requires local low-privileged access rather than being remotely reachable.

What it is

CVE-2023-33107 is an integer overflow (CWE-190) in Qualcomm Graphics Linux that causes memory corruption when a shared virtual memory region is assigned during an IOCTL call. It affects a broad set of Qualcomm chipsets and modem firmware, and CISA added it to the Known Exploited Vulnerabilities catalog, so it warrants prompt remediation.

Impact

An attacker who can reach the vulnerable IOCTL gains memory corruption with high confidentiality, integrity and availability impact, potentially leading to code execution or privilege escalation in the graphics subsystem.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by a local process issuing a crafted IOCTL to the Graphics Linux driver rather than over the network.

Exploitation

CISA added this to the KEV catalog on 2023-12-05 with a remediation due date of 2023-12-26, indicating known exploitation; EPSS is low at roughly 0.9 percent for the next 30 days, and no ransomware campaign use is documented.

What to do

  • Apply the Qualcomm December 2023 security bulletin patches for all affected chipsets and firmware listed in the advisory
  • If patching is not possible, follow vendor mitigations or discontinue use of the affected product per CISA's required action
  • Restrict local access and limit untrusted processes or apps that can issue IOCTLs to the graphics driver
  • Track the CISA KEV due date of 2023-12-26 and confirm remediation across all affected device models

Detection

  • Monitor for crashes, memory corruption errors or anomalous IOCTL activity involving the Graphics Linux driver
  • Audit local processes and apps with access to graphics device nodes on affected Qualcomm devices
  • Check asset inventory against the Qualcomm affected product list to find unpatched devices

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-33107 to the Known Exploited Vulnerabilities catalog on 5 December 2023 as "Qualcomm Multiple Chipsets Integer Overflow Vulnerability". Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Federal deadline 26 December 2023.

Affected products

150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin PatchVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107 US Government Resource

Track CVE-2023-33107 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2025-21479Qualcomm GPU micronode memory corruption via unauthorized command executionQualcomm chipsets contain an incorrect authorization flaw in the GPU micronode that allows memory corruption when a specific sequence of commands is …KEVEPSS 0.84%analysed8.6CVE-2025-21480Qualcomm GPU micronode memory corruption via unauthorized command executionA memory corruption flaw in Qualcomm's GPU micronode is caused by incorrect authorization (CWE-863), allowing an unauthorized command sequence to be …KEVEPSS 0.46%analysed7.8CVE-2026-21385Qualcomm chipset firmware memory corruption via alignment integer overflowA memory corruption flaw in Qualcomm chipset firmware arises from an integer overflow when alignments are used for memory allocation (CWE-190). It af…KEVEPSS 1.2%analysed7.8CVE-2023-33063Qualcomm DSP Services use-after-free memory corruptionCVE-2023-33063 is a use-after-free memory corruption flaw in Qualcomm DSP Services, triggered during a remote call from the high-level operating syst…KEVEPSS 0.69%analysed7.8CVE-2022-22071Qualcomm chipset shell memory use-after-free via IOCTL munmapA use-after-free exists in Qualcomm Snapdragon and related chipset firmware when process shell memory is freed through an IOCTL munmap call while pro…KEVEPSS 0.46%analysed7.8CVE-2020-11261Qualcomm Snapdragon chipsets memory corruption via improper allocation size checkQualcomm Snapdragon firmware fails to return an error when a user application requests a very large memory allocation, leading to memory corruption (…KEVEPSS 1.6%analysed7.8CVE-2021-1905Qualcomm Snapdragon chipsets use-after-free in memory mapping handlingA use-after-free flaw exists in multiple Qualcomm Snapdragon chipset families due to improper handling of memory mapping when multiple processes oper…KEVEPSS 1.5%analysed7.5CVE-2025-27038Qualcomm Adreno GPU driver use-after-free in Chrome graphics renderingA use-after-free (CWE-416) in Qualcomm Adreno GPU drivers causes memory corruption while rendering graphics in Chrome. It affects a broad set of Qual…KEVEPSS 1.0%analysed

Source: NIST National Vulnerability Database (record CVE-2023-33107), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.