CVE-2023-21672
📛 CVE Title
Use After Free in Audio
Description
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- qualcomm
- CVSS severity
- HIGH
- CVSS score
- 8.4 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.4 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-416 - Reserved
- 2022-12-07
- Published
- 2023-07-04 06:46 UTC
- Last updated
- 2024-08-02 11:44 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/21xxx/CVE-2023-21672.json
- Linked Threat
- CVE-2023-21672 — Use After Free in Audio
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-25839 - Assigner
- qualcomm
- Published
- Jul 4, 2023, 4:46:37 AM
- Updated
- Aug 2, 2024, 9:44:02 AM
- EUVD base score (CVSS 3.1)
-
8.4 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0500
- Vendors
- Qualcomm, Inc.
- Products
-
Snapdragon (WCD9370)Snapdragon (QCA6797AQ)Snapdragon (QCA6696)Snapdragon (FastConnect 6700)Snapdragon (SA8295P)Snapdragon (WCD9385)Snapdragon (FastConnect 6900)Snapdragon (WCN6740)Snapdragon (WSA8832)Snapdragon (SA6155P)Snapdragon (Snapdragon 8+ Gen 1 Mobile Platform)Snapdragon (Snapdragon XR2 5G Platform)Snapdragon (SA4155P)Snapdragon (WSA8835)Snapdragon (QAM8775P)Snapdragon (QCA6574)Snapdragon (Snapdragon 685 4G Mobile Platform (SM6225-AD))Snapdragon (WSA8815)Snapdragon (SW5100)Snapdragon (QCA6595)Snapdragon (WCN3950)Snapdragon (Snapdragon 4 Gen 2 Mobile Platform)Snapdragon (SD865 5G)Snapdragon (QCA6574A)Snapdragon (SA4150P)Snapdragon (SA8195P)Snapdragon (SW5100P)Snapdragon (WCD9380)Snapdragon (SD 8 Gen1 5G)Snapdragon (Snapdragon 680 4G Mobile Platform)Snapdragon (SA8145P)Snapdragon (WSA8830)Snapdragon (SSG2125P)Snapdragon (SG4150P)Snapdragon (WCN3980)Snapdragon (Snapdragon AR2 Gen 1 Platform)Snapdragon (SSG2115P)Snapdragon (QCM4325)Snapdragon (QCA6574AU)Snapdragon (SA8255P)Snapdragon (QCA6595AU)Snapdragon (QAM8255P)Snapdragon (WCD9375)Snapdragon (SA6145P)Snapdragon (Snapdragon 8 Gen 1 Mobile Platform)Snapdragon (QAM8295P)Snapdragon (SXR2230P)Snapdragon (QCA6698AQ)Snapdragon (FastConnect 7800)Snapdragon (SA8155P)Snapdragon (WSA8810)Snapdragon (QAM8650P)Snapdragon (Snapdragon W5+ Gen 1 Wearable Platform)Snapdragon (SXR1230P)Snapdragon (WCN3988)Snapdragon (SA8150P)Snapdragon (SA6150P)
- Aliases
-
GHSA-32pq-c6vh-9cq5
ENISA description: Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Qualcomm, Inc. | Snapdragon |
FastConnect 6700 (affected),
FastConnect 6900 (affected),
FastConnect 7800 (affected),
QAM8255P (affected),
QAM8295P (affected),
QAM8650P (affected),
QAM8775P (affected),
QCA6574 (affected),
QCA6574A (affected),
QCA6574AU (affected),
QCA6595 (affected),
QCA6595AU (affected),
QCA6696 (affected),
QCA6698AQ (affected),
QCA6797AQ (affected),
QCM4325 (affected),
SA4150P (affected),
SA4155P (affected),
SA6145P (affected),
SA6150P (affected),
SA6155P (affected),
SA8145P (affected),
SA8150P (affected),
SA8155P (affected),
SA8195P (affected),
SA8255P (affected),
SA8295P (affected),
SD 8 Gen1 5G (affected),
SD865 5G (affected),
SG4150P (affected),
Snapdragon 4 Gen 2 Mobile Platform (affected),
Snapdragon 680 4G Mobile Platform (affected),
Snapdragon 685 4G Mobile Platform (SM6225-AD) (affected),
Snapdragon 8 Gen 1 Mobile Platform (affected),
Snapdragon 8+ Gen 1 Mobile Platform (affected),
Snapdragon AR2 Gen 1 Platform (affected),
Snapdragon W5+ Gen 1 Wearable Platform (affected),
Snapdragon XR2 5G Platform (affected),
SSG2115P (affected),
SSG2125P (affected),
SW5100 (affected),
SW5100P (affected),
SXR1230P (affected),
SXR2230P (affected),
WCD9370 (affected),
WCD9375 (affected),
WCD9380 (affected),
WCD9385 (affected),
WCN3950 (affected),
WCN3980 (affected),
WCN3988 (affected),
WCN6740 (affected),
WSA8810 (affected),
WSA8815 (affected),
WSA8830 (affected),
WSA8832 (affected),
WSA8835 (affected)
|
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.oracle.com
Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.
2026-06-04 03:43 UTC -
web:nvd.nist.gov
Vulnerabilities All vulnerabilities in the NVD have been assigned a CVE identifier and thus, abide by the definition below. CVE defines a vulnerability as: "A weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this ...
2026-06-04 03:43 UTC -
web:gemini.google.com
Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.
2026-06-04 03:43 UTC -
web:www.rapid7.com
Microsoft is publishing 77 vulnerabilities this Patch Tuesday, including two publicly disclosed zero-day vulnerabilities.
2026-06-04 03:43 UTC -
web:www.grammarly.com
Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.
2026-06-04 03:43 UTC -
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-06-04 03:43 UTC -
web:www.experts-exchange.com
Learn more about Resolving Sweet32, Birthday Attacks on Windows Servers Via GPO from the expert community at Experts Exchange
2026-05-22 05:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 05:45 UTC -
web:www.pcworld.com
Microsoft has released an emergency update for Windows 11. Update KB5086672 is an out-of-band update intended to resolve issues caused by the optional Windows update KB5079391 from late March ...
2026-05-22 05:45 UTC -
web:www.techrepublic.com
Google patches eight high-severity Chrome vulnerabilities affecting 3.5 billion users. Here's why you should update and relaunch your browser now.
2026-05-22 05:45 UTC -
web:www.virustotal.com
VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.
2026-05-22 05:45 UTC -
web:cyberinsider.com
Google has released Chrome 148, one of the largest security update batches in the browser's history, patching 127 vulnerabilities.
2026-05-22 05:45 UTC -
web:cybersecuritynews.com
Google released a critical Chrome update fixing multiple high-risk vulnerabilities that could enable arbitrary code execution.
2026-05-22 05:45 UTC -
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-05-22 05:45 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 05:45 UTC -
web:source.android.com
This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.
2026-05-22 05:45 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-21672.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:44:02.233Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Snapdragon Auto",
"Snapdragon Compute",
"Snapdragon Connectivity",
"Snapdragon Industrial IOT",
"Snapdragon Mobile",
"Snapdragon Wearables"
],
"product": "Snapdragon",
"vendor": "Qualcomm, Inc.",
"versions": [
{
"status": "affected",
"version": "FastConnect 6700"
},
{
"status": "affected",
"version": "FastConnect 6900"
},
{
"status": "affected",
"version": "FastConnect 7800"
},
{
"status": "affected",
"version": "QAM8255P"
},
{
"status": "affected",
"version": "QAM8295P"
},
{
"status": "affected",
"version": "QAM8650P"
},
{
"status": "affected",
"version": "QAM8775P"
},
{
"status": "affected",
"version": "QCA6574"
},
{
"status": "affected",
"version": "QCA6574A"
},
{
"status": "affected",
"version": "QCA6574AU"
},
{
"status": "affected",
"version": "QCA6595"
},
{
"status": "affected",
"version": "QCA6595AU"
},
{
"status": "affected",
"version": "QCA6696"
},
{
"status": "affected",
"version": "QCA6698AQ"
},
{
"status": "affected",
"version": "QCA6797AQ"
},
{
"status": "affected",
"version": "QCM4325"
},
{
"status": "affected",
"version": "SA4150P"
},
{
"status": "affected",
"version": "SA4155P"
},
{
"status": "affected",
"version": "SA6145P"
},
{
"status": "affected",
"version": "SA6150P"
},
{
"status": "affected",
"version": "SA6155P"
},
{
"status": "affected",
"version": "SA8145P"
},
{
"status": "affected",
"version": "SA8150P"
},
{
"status": "affected",
"version": "SA8155P"
},
{
"status": "affected",
"version": "SA8195P"
},
{
"status": "affected",
"version": "SA8255P"
},
{
"status": "affected",
"version": "SA8295P"
},
{
"status": "affected",
"version": "SD 8 Gen1 5G"
},
{
"status": "affected",
"version": "SD865 5G"
},
{
"status": "affected",
"version": "SG4150P"
},
{
"status": "affected",
"version": "Snapdragon 4 Gen 2 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 680 4G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 685 4G Mobile Platform (SM6225-AD)"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 1 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8+ Gen 1 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon AR2 Gen 1 Platform"
},
{
"status": "affected",
"version": "Snapdragon W5+ Gen 1 Wearable Platform"
},
{
"status": "affected",
"version": "Snapdragon XR2 5G Platform"
},
{
"status": "affected",
"version": "SSG2115P"
},
{
"status": "affected",
"version": "SSG2125P"
},
{
"status": "affected",
"version": "SW5100"
},
{
"status": "affected",
"version": "SW5100P"
},
{
"status": "affected",
"version": "SXR1230P"
},
{
"status": "affected",
"version": "SXR2230P"
},
{
"status": "affected",
"version": "WCD9370"
},
{
"status": "affected",
"version": "WCD9375"
},
{
"status": "affected",
"version": "WCD9380"
},
{
"status": "affected",
"version": "WCD9385"
},
{
"status": "affected",
"version": "WCN3950"
},
{
"status": "affected",
"version": "WCN3980"
},
{
"status": "affected",
"version": "WCN3988"
},
{
"status": "affected",
"version": "WCN6740"
},
{
"status": "affected",
"version": "WSA8810"
},
{
"status": "affected",
"version": "WSA8815"
},
{
"status": "affected",
"version": "WSA8830"
},
{
"status": "affected",
"version": "WSA8832"
},
{
"status": "affected",
"version": "WSA8835"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-12T16:24:59.149Z",
"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"shortName": "qualcomm"
},
"references": [
{
"url": "https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin"
}
],
"title": "Use After Free in Audio"
}
},
"cveMetadata": {
"assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"assignerShortName": "qualcomm",
"cveId": "CVE-2023-21672",
"datePublished": "2023-07-04T04:46:37.961Z",
"dateReserved": "2022-12-07T02:58:25.876Z",
"dateUpdated": "2024-08-02T09:44:02.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}