CVE-2023-28586

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

6.0 Medium

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.14%Up 0.1 points since Dec 5, 2023

What each source reports

CVE List Score used 6.0

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Record: CVE-2023-28586
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

EUVDEUVD-2023-32256 6.0

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Record: EUVD-2023-32256
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3v52-wmx3-8w9p 6.0

Information disclosure when the trusted application metadata symbol addresses are accessed while...

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Record: GHSA-3v52-wmx3-8w9p
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

NVD 6.0

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Record: CVE-2023-28586
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Show 302 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28586 is a medium vulnerability (CVSS 6.0) in Qualcomm 315 5g Iot Modem Firmware, published December 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. No source names a fixed version.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

History

In short

References