CVE-2022-40533 Untrusted Pointer Dereference in Core
An attacker can cause a transient denial of service in Qualcomm Snapdragon devices via untrusted pointer dereference during USB QMI requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40533?
CVE-2022-40533 is a medium-severity vulnerability in Qualcomm Csra6620 Firmware, published on 6 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
Which versions are affected by CVE-2022-40533?
It affects 110 products.
Products include Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Flight Rb5 5g Platform Firmware, Qualcomm Qam8255p Firmware, Qualcomm Qam8295p Firmware, Qualcomm Qam8650p Firmware and 104 more.
How do I fix CVE-2022-40533?
No fix has been published for CVE-2022-40533 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-40533 being exploited?
There is no known exploitation of CVE-2022-40533 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Csra6620 Firmware
- CVE-2025-27063 Use After Free in Video
- CVE-2024-49834 Improper Validation of Array Index in Camera
- CVE-2023-21657 Improper Input Validation in Audio
- CVE-2025-47334 Buffer Copy Without Checking Size of Input in Camera Driver
- CVE-2025-47344 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Sources
Also known as GHSA-pgpp-8mv3-rmg6.