Multiple Qualcomm chipsets have a use-after-free vulnerability triggered during process initialization when shell memory is freed via an IOCTL munmap call. This vulnerability has been exploited in the wild and is rated as high severity.
CVE-2023-33074 is a high-severity use-after-free vulnerability in Qualcomm Snapdragon chipsets affecting audio components when a subsystem restart (SSR) event occurs after music playback stops. It can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service without requiring user interaction or privileges. The vulnerability impacts a wide range of Snapdragon platforms, including mobile, wearable, and XR devices. No known exploits are currently reported in the wild. European organizations using devices with affected Snapdragon chipsets, especially in critical communication or IoT infrastructure, could face confidentiality, integrity, and availability risks. Mitigation requires timely firmware and software updates from device manufacturers and careful monitoring of SSR event handling. Countries with high smartphone and IoT adoption, such as Germany, France, and the UK, are most likely to be affected due to market penetration and strategic importance. Given the ease of exploitation and broad impact, this vulnerability is rated as high severity.
CVE-2023-33059 is a high-severity integer underflow vulnerability (CWE-191) affecting a wide range of Qualcomm Snapdragon platforms and related chipsets. The flaw occurs due to improper handling of VOC packet data in the audio processing component of the ADSP, leading to memory corruption. Exploitation requires local privileges and no user interaction, potentially allowing attackers to compromise confidentiality, integrity, and availability of affected devices. This vulnerability impacts numerous Snapdragon-based devices, including mobile phones, IoT devices, automotive platforms, and wearable technology. Although no known exploits are currently reported in the wild, the broad range of affected products and the high CVSS score (7.8) indicate significant risk. European organizations relying on Snapdragon-powered devices, especially in telecommunications, automotive, and industrial IoT sectors, may face operational and security risks. Mitigation requires timely patching from device manufacturers and applying strict input validation and memory safety checks in audio processing modules. Countries with high adoption of Snapdragon devices and advanced automotive or IoT industries, such as Germany, France, the UK, and the Nordics, are most likely to be affected. Due to the complexity and privilege requirements, exploitation is moderately difficult but impactful, warranting urgent attention from defenders.
CVE-2023-33055 is a high-severity buffer overflow vulnerability in Qualcomm Snapdragon platforms affecting a wide range of mobile, wearable, automotive, and IoT devices. The flaw arises from improper size checking during a buffer copy operation in the audio driver callback function within the ADSP (Audio DSP) subsystem, leading to memory corruption. Exploitation requires local privileges and no user interaction but can result in full confidentiality, integrity, and availability compromise. This vulnerability impacts numerous Snapdragon chipsets widely used in smartphones and embedded devices across Europe. Although no known exploits are currently reported in the wild, the potential for privilege escalation or arbitrary code execution is significant. European organizations relying on affected devices should prioritize patching once available and implement strict access controls to mitigate risk. Countries with high smartphone penetration and strong industrial IoT adoption are most at risk. The vulnerability is rated with a CVSS score of 7.8 (high), reflecting its serious impact and moderate exploit complexity.
CVE-2023-33031 is a high-severity buffer overflow vulnerability in Qualcomm Snapdragon platforms affecting a wide range of mobile, automotive, and IoT devices. The flaw arises from improper size checking when copying data from the ADSP shared buffer to the VOC packet data buffer in the Automotive Audio component, leading to memory corruption. Exploitation requires local privileges and no user interaction, potentially allowing attackers to execute arbitrary code with elevated privileges, compromising confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the extensive list of affected Snapdragon versions and platforms increases the risk. European organizations using devices or embedded systems with these Qualcomm components, especially in automotive, mobile, and industrial sectors, face significant security risks. Mitigation requires prompt application of vendor patches once available, strict access controls to limit local privilege escalation, and monitoring for anomalous behavior in affected systems. Countries with strong automotive industries and high adoption of Snapdragon-based devices, such as Germany, France, Italy, and the UK, are particularly at risk. Given the complexity and privileged nature of the vulnerability, the severity is assessed as high, demanding immediate attention from defenders.
CVE-2023-22388 is a critical memory corruption vulnerability in Qualcomm Snapdragon chipsets affecting a wide range of products including modems, mobile platforms, and wearable devices. The flaw arises from an out-of-range pointer offset in the Multi-mode Call Processor while handling a bit mask API, leading to potential arbitrary code execution or system compromise without requiring user interaction or privileges. With a CVSS score of 9.8, this vulnerability impacts confidentiality, integrity, and availability, and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the extensive list of affected Snapdragon platforms means a broad attack surface across many mobile and IoT devices. European organizations relying on devices with these chipsets, especially in telecommunications, automotive, and industrial IoT sectors, face significant risks. Mitigation requires prompt application of vendor patches once available, network-level protections, and monitoring for anomalous device behavior. Countries with high adoption of Qualcomm Snapdragon devices and advanced telecom infrastructure, such as Germany, France, the UK, and the Nordics, are most likely to be affected. Given the critical severity and ease of exploitation, immediate attention is warranted to prevent potential large-scale compromise.
CVE-2020-11261 is a high-severity vulnerability affecting multiple Qualcomm Snapdragon chipsets. It involves improper input validation that can lead to memory corruption when a user application requests an excessively large memory allocation. The affected Snapdragon platforms include Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
Multiple Qualcomm chipsets are affected by a use-after-free vulnerability caused by improper handling of memory mapping across multiple processes. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patches are provided in the available data.
Multiple Qualcomm chipsets have a vulnerability where detection of an error condition does not trigger appropriate action. Specifically, improper handling of address deregistration failures can cause subsequent GPU address allocation failures. This issue has been exploited in the wild and is considered high severity.
