CVE-2022-33280
Access of uninitialized pointer in Bluetooth HOST
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Access of uninitialized pointer in Bluetooth HOST
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
- Record
CVE-2022-33280- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-824
- Updated
- 2026-11-02
EUVDEUVD-2022-36323
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
- Record
EUVD-2022-36323- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-278x-ph66-x5gw
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the...
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
- Record
GHSA-278x-ph66-x5gw- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787, CWE-824
- Updated
- 2026-11-02
NVD
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
- Record
CVE-2022-33280- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-824
- Updated
- 2026-11-02
Affected products
- qualcomm apq8096au firmware
- qualcomm ar8031 firmware
- qualcomm ar8035 firmware
- qualcomm csra6620 firmware
- qualcomm csra6640 firmware
- qualcomm mdm9150 firmware
- qualcomm mdm9250 firmware
- qualcomm mdm9628 firmware
- qualcomm mdm9650 firmware
- qualcomm qca6174a firmware
- qualcomm qca6391 firmware
- qualcomm qca6564a firmware
Show 51 moreShow less
- qualcomm qca6564au firmware
- qualcomm qca6574a firmware
- qualcomm qca6574au firmware
- qualcomm qca6584au firmware
- qualcomm qca6595au firmware
- qualcomm qca8081 firmware
- qualcomm qca8337 firmware
- qualcomm qca9377 firmware
- qualcomm qcn6024 firmware
- qualcomm qcn9011 firmware
- qualcomm qcn9012 firmware
- qualcomm qcn9024 firmware
- qualcomm qcn9074 firmware
- qualcomm qcs405 firmware
- qualcomm qcs410 firmware
- qualcomm qcs605 firmware
- qualcomm qcs610 firmware
- qualcomm qrb5165 firmware
- qualcomm qrb5165m firmware
- qualcomm qrb5165n firmware
- qualcomm sa6155p firmware
- qualcomm sa8155p firmware
- qualcomm sa8195p firmware
- qualcomm sd429 firmware
- qualcomm sd626 firmware
- qualcomm sd835 firmware
- qualcomm sdm429w firmware
- qualcomm sdx20 firmware
- qualcomm sdx20m firmware
- qualcomm sdx24 firmware
- qualcomm sdx55 firmware
- qualcomm sdx65 firmware
- qualcomm wcd9326 firmware
- qualcomm wcd9335 firmware
- qualcomm wcd9341 firmware
- qualcomm wcd9370 firmware
- qualcomm wcd9380 firmware
- qualcomm wcd9385 firmware
- qualcomm wcn3620 firmware
- qualcomm wcn3660b firmware
- qualcomm wcn3680b firmware
- qualcomm wcn3950 firmware
- qualcomm wcn3980 firmware
- qualcomm wcn3988 firmware
- qualcomm wcn3990 firmware
- qualcomm wcn3998 firmware
- qualcomm wcn6855 firmware
- qualcomm wcn6856 firmware
- qualcomm wsa8810 firmware
- qualcomm wsa8815 firmware
- qualcomm, inc. snapdragon
Affected packages
| Package | Affected | Fixed |
|---|---|---|
platform/vendor/qcom-opensource/bluetoothAndroid |
SoCVersion:0 up to SoCVersion:2023-02-05, plus listed versions SoCVersion |
SoCVersion:2023-02-05 |
platform/vendor/qcom-opensource/bluetooth_extAndroid |
SoCVersion:0 up to SoCVersion:2023-02-05, plus listed versions SoCVersion |
SoCVersion:2023-02-05 |
platform/vendor/qcom-opensource/system/btAndroid |
SoCVersion:0 up to SoCVersion:2023-02-05, plus listed versions SoCVersion |
SoCVersion:2023-02-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-33280 is a high vulnerability (CVSS 7.3) in Qualcomm Apq8096au Firmware, published February 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in platform/vendor/qcom-opensource/bluetooth SoCVersion:2023-02-05.
References
qualcomm.com/company/product-security/bulletins/february-2023-bulletin
nvd.nist.gov/vuln/detail/CVE-2022-33280
github.com/advisories/GHSA-278x-ph66-x5gw
source.android.com/security/bulletin/2023-02-01
git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/bluetooth/-/commit/3b74f1cbe3e849adf717dc2ad1a58c84b91b729b