CVE-2023-33032 Integer Overflow or Wraparound in TZ Secure OS

Critical 9.3 Published 2 Jan 2024 Updated 16 Jun 2025

An integer overflow in Qualcomm's TZ Secure OS allows memory corruption, potentially enabling code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33032?

CVE-2023-33032 is a critical vulnerability in Qualcomm Aqt1000 Firmware, published on 2 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2023-33032?

It affects 117 products.

Products include Qualcomm 9205 Lte Modem Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm C-V2x 9150 Firmware, Qualcomm Csr8811 Firmware, Qualcomm Csra6620 Firmware and 111 more.

How do I fix CVE-2023-33032?

No fix has been published for CVE-2023-33032 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33032 being exploited?

There is no known exploitation of CVE-2023-33032 in the wild and no public exploit code.

All Qualcomm Aqt1000 Firmware vulnerabilities

Sources

Also known as GHSA-q9h6-c2ff-prcp.