CVE-2023-28588

highpriority · track · 40EPSS 0.005 · 44 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

0.52% (44th) EPSS

CVSS 7.5 · high

Is it mine?

430 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

Transient DOS in Bluetooth Host while rfc slot allocation.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · product-security@qualcomm.comexploitability 3.9 · impact 3.6

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USprimary

exploits (5)

Public proof-of-concept and weaponised exploit code.

Trinadh465/CVE-2023-28588Trinadh465/CVE-2023-28588PoC · poc_in_github
uthrasri/CVE-2023-28588uthrasri/CVE-2023-28588PoC · poc_in_github
uthrasri/CVE-2023-28588_G2.5_singlefileuthrasri/CVE-2023-28588_G2.5_singlefilePoC · poc_in_github
uthrasri/CVE-2023-28588_Singlefileuthrasri/CVE-2023-28588_SinglefilePoC · poc_in_github
uthrasri/CVE-2023-28588_system_btsystem_bt_CVE-2023-28588PoC · poc_in_github

affected products (430)

Products and version ranges known to be affected.

Google Androidall versionscert_bundDEcpe:/o:google:android:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Qualcomm, Inc. Snapdragon≤ Snapdragon 730G Mobile Platform (SM7150-AB)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 730 Mobile Platform (SM7150-AA)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ CSRA6640enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SSG2115Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WSA8815enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ WCD9395enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ APQ8064AUenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 625 Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Qualcomm 215 Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 685 4G Mobile Platform (SM6225-AD)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 460 Mobile Platformenisa_euvdEU
Qualcomm, Inc. Snapdragon≤ QCA6574enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA4150Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SA4155Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SG8275Penisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Snapdragon 870 5G Mobile Platform (SM8250-AC)enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ SD675enisa_euvdEU
Qualcomm, Inc. Snapdragon≤ Qualcomm Video Collaboration VC3 Platformenisa_euvdEU

showing 20 of 430

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-3057Google Android: Mehrere SchwachstellenDeutsch2023-12-04csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.
ASB-A-2859027292023-12-01vendor · osvUS

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund NVD CVE.org MITRE

published 2023-12-05modified 2026-06-17

related (4,649)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-48595US	—OT critical	1.95% (80th)	KEV	2026-06-01
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution p…
CVE-2026-21385US	—OT critical	1.29% (70th)	KEV	2026-03-02
Memory corruption while using alignments for memory allocation.
CVE-2025-24985US	—OT critical	3.89% (90th)	KEV	2025-03-11
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
CVE-2024-38080US	—OT critical	7.12% (94th)	KEV	2024-07-09
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2023-33107US	high7.8OT critical	0.74% (54th)	KEV	2023-12-05
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

+4644 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan