What’s Vulnerable › Vulnerabilities

CVE-2022-33299: Null pointer dereference in Bluetooth HOST

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-09 · updated 2026-06-17
Weakness: CWE-476

Description

Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.

Affected products

Qualcomm Apq8017 Firmware: all versions
Qualcomm Apq8096Au Firmware: all versions
Qualcomm Ar8031 Firmware: all versions
Qualcomm Csra6620 Firmware: all versions
Qualcomm Csra6640 Firmware: all versions
Qualcomm Csrb31024 Firmware: all versions
Qualcomm Mdm9150 Firmware: all versions
Qualcomm Mdm9206 Firmware: all versions
Qualcomm Mdm9250 Firmware: all versions
Qualcomm Mdm9607 Firmware: all versions
Qualcomm Mdm9628 Firmware: all versions
Qualcomm Mdm9640 Firmware: all versions
Qualcomm Mdm9650 Firmware: all versions
Qualcomm Msm8996Au Firmware: all versions
Qualcomm Qca6174A Firmware: all versions
Qualcomm Qca6175A Firmware: all versions
Qualcomm Qca6564A Firmware: all versions
Qualcomm Qca6564Au Firmware: all versions
Qualcomm Qca6574 Firmware: all versions
Qualcomm Qca6574A Firmware: all versions
Qualcomm Qca6574Au Firmware: all versions
Qualcomm Qca6584 Firmware: all versions
Qualcomm Qca6584Au Firmware: all versions
Qualcomm Qca6595 Firmware: all versions
Qualcomm Qca6595Au Firmware: all versions
Qualcomm Qca6696 Firmware: all versions
Qualcomm Qca9367 Firmware: all versions
Qualcomm Qca9377 Firmware: all versions
Qualcomm Qcn9074 Firmware: all versions
Qualcomm Qcs405 Firmware: all versions

References

Get alerted when CVE-2022-33299 or the next vulnerability affects your stack