First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-33058

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	AQT1000; AR8035; FastConnect 6200; FastConnect 6700; FastConnect 6800; FastConnect 6900; FastConnect 7800; QAM8255P; QAM8295P; QAM8620P; QAM8650P; QAM8775P; QAMSRV1H; QAMSRV1M; QCA6174A; QCA6310; QCA6335; QCA6391; QCA6420; QCA6421

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.htmlVendor Advisory

Timeline

Published: Apr 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-330597.8Memory corruption while processing frame command IOCTL calls.CVE-2024-33067.5Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Acces CVE-2024-330607.8Memory corruption when two threads try to map and unmap a single node simultaneously.CVE-2024-330615.5Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing CVE-2024-330637.5Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is CVE-2024-330648.2Information disclosure while parsing the multiple MBSSID IEs from the beacon.CVE-2024-330657.8Memory corruption while taking snapshot when an offset variable is set by camera driver.CVE-2024-330669.8Memory corruption while redirecting log file to any file location with any file name.CVE-2024-330675.5Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model dri CVE-2024-330686.5Transient DOS while parsing fragments of MBSSID IE from beacon frame.CVE-2024-330697.5Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.CVE-2024-33075.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's att

CVE-2024-33058: High severity, CVSS 7.5 | Vulnix