CVE-2023-21655 Integer Overflow or Wraparound in Display
An integer overflow in Qualcomm Snapdragon audio drivers allows attackers to cause memory corruption, potentially leading to code execution or privilege escalation on Android devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-21655?
CVE-2023-21655 is a medium-severity vulnerability in Qualcomm Qca6391 Firmware, published on 5 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption in Audio while validating and mapping metadata.
Weakness: CWE-190
Which versions are affected by CVE-2023-21655?
It affects 31 products.
Products include Qualcomm Qca6391 Firmware, Qualcomm Qca6574au Firmware, Qualcomm Qca6696 Firmware, Qualcomm Qcc5100 Firmware, Qualcomm Sa6145p Firmware, Qualcomm Sa6150p Firmware and 25 more.
How do I fix CVE-2023-21655?
Apply the vendor's patch.
Is CVE-2023-21655 being exploited?
There is no known exploitation of CVE-2023-21655 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qca6391 Firmware
- CVE-2023-21630 Integer Overflow in Multimedia Framework
- CVE-2021-35134 Memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- CVE-2025-21476 Buffer Copy Without Checking Size of Input in Computer Vision
- CVE-2021-30283 Denial of service in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- CVE-2021-1918 Information disclosure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Sources
Also known as 3321695, A-253296923, GHSA-cqww-fvwv-8hfg, PUB-A-253296923.