CVE-2023-33034: qualcomm, inc. snapdragon Signed to Unsigned Conversion Error

Vulnerability summary

CVE-2023-33034 is a high (CVSS 7.8) Signed to Unsigned Conversion Error vulnerability in qualcomm, inc. snapdragon. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.4% of scored vulnerabilities.

Timeline

1. 03-10-2023
   PublishedVulnerability first disclosed.
2. 27-02-2025
   Last modifiedVulnerability information updated.

Description

Memory corruption while parsing the ADSP response command.

• CWE-195Signed to Unsigned Conversion ErrorThe product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.