Security readout for executives and security teams
Plain-English summary
CVE-2023-33106 is a Qualcomm Snapdragon graphics-driver memory corruption issue. A local attacker could trigger it through GPU AUX command handling and potentially compromise confidentiality, integrity, and availability. CISA lists it in KEV, so exploitation is supported by a government source.
Executive priority
Treat this as urgent for Qualcomm-based fleets because CISA confirms exploitation and the potential impact is full device compromise. Focus first on managed mobile, embedded, automotive, robotics, and specialty devices where firmware updates are slower or harder to verify.
Technical view
The flaw is CWE-823, an out-of-range pointer offset in graphics code during submission of a large sync-point list to IOCTL_KGSL_GPU_AUX_COMMAND. CVSS 3.1 is 8.4 with local attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely on devices or embedded products using the affected Qualcomm Snapdragon and related platforms listed by Qualcomm. Risk depends on OEM firmware, driver integration, and whether the vendor has delivered the December 2023 Qualcomm security fixes.
Exploitation context
Active exploitation is supported because CISA lists CVE-2023-33106 in the Known Exploited Vulnerabilities catalog. The provided sources do not describe exploit volume, targets, proof-of-concept availability, or attack chains.
Researcher notes
The bundle does not include exploit mechanics or precise fixed build identifiers. Validation should center on chipset identification, KGSL graphics-driver patch lineage, OEM advisory mapping, and confirmation that Qualcomm’s December 2023 bulletin fixes are present in deployed firmware.
Mitigation direction
- Check Qualcomm’s December 2023 bulletin for vendor guidance and affected platform details.
- Prioritize OEM firmware or security updates for devices using listed Qualcomm platforms.
- Track handset, embedded, automotive, robotics, and wearable vendor advisories for incorporated Qualcomm fixes.
- Apply CISA KEV remediation requirements where they govern the organization.
- If no update exists, contact the OEM for fixed firmware status and compensating guidance.
Validation and detection
- Inventory assets using affected Qualcomm Snapdragon or related platforms from the source list.
- Map each asset to its OEM firmware and security patch level.
- Confirm whether the OEM update includes Qualcomm’s December 2023 graphics fix.
- Review CISA KEV status for exploited-vulnerability tracking.
- Document assets with no available fix for risk acceptance or vendor escalation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-823: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-33106 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletinCVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33106CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Out-of-range Pointer Offset
Use of Out-of-range Pointer Offset represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.