by Kastro
Paper/Archive/CVE-2022-40510

CVE-2022-40510

Qualcomm, Inc. Snapdragon — Buffer copy without checking size of input in Audio.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.0.370 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

Affected

ProductAffectedFixed inSource
SnapdragonAPQ8009–CNA
SnapdragonAPQ8009W–CNA
SnapdragonAPQ8017–CNA
SnapdragonAPQ8037–CNA
SnapdragonAPQ8064AU–CNA
SnapdragonAPQ8076–CNA
SnapdragonAPQ8096AU–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8031–CNA
SnapdragonAR8035–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqualcomm.com/company/product-security/bulletins/august-2023-bulletin