PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-33106 Qualcomm CVE debrief

CVE-2023-33106 is a Qualcomm Multiple Chipsets issue described as a use of out-of-range pointer offset vulnerability. CISA has added it to the Known Exploited Vulnerabilities catalog, so defenders should treat it as a live risk rather than a purely theoretical bug. Because CISA notes that the issue may affect a common open-source component, third-party library, or protocol used by different products, remediation can vary by downstream vendor.

Vendor
Qualcomm
Product
Multiple Chipsets
CVSS
HIGH 8.4
CISA KEV
Listed
Original CVE published
2023-12-05
Original CVE updated
2023-12-05
Advisory published
2023-12-05
Advisory updated
2023-12-05

Who should care

Organizations using Qualcomm-based devices or components, as well as OEMs and vendors that ship products built on affected Qualcomm chipsets or shared downstream components, should prioritize this CVE.

Technical summary

The official description identifies an out-of-range pointer offset condition in Qualcomm Multiple Chipsets. CISA’s KEV entry indicates known exploitation and advises checking vendor-specific patching status, which suggests the affected code path may be embedded in a shared component used across multiple products.

Defensive priority

Immediate

Recommended defensive actions

  • Check whether any in-scope devices, firmware, or vendor products include the affected Qualcomm component.
  • Apply vendor remediations or mitigations as soon as they are available.
  • If remediation or mitigations are unavailable, discontinue use of the affected product per CISA guidance.
  • Confirm patching status with each downstream vendor, since CISA notes the issue may appear in shared components used by different products.
  • Verify remediation after deployment and keep records of affected assets and vendor advisories.

Evidence notes

This debrief is limited to the supplied official records and links. CISA’s KEV data identifies CVE-2023-33106 as a known exploited vulnerability, with dateAdded 2023-12-05 and dueDate 2023-12-26, and states: 'Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.' The KEV notes also say the issue may affect a common open-source component, third-party library, or protocol used by different products, so patch status may differ by vendor. No CVSS score was provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-33106 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-33106

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-33106 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-33106

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.