by Kastro
Paper/Archive/CVE-2022-40515

CVE-2022-40515

Qualcomm, Inc. Snapdragon — Double free in Video

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 25.7.257 × 205.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Affected

ProductAffectedFixed inSource
SnapdragonAPQ8009–CNA
SnapdragonAPQ8009W–CNA
SnapdragonAPQ8052–CNA
SnapdragonAPQ8056–CNA
SnapdragonAPQ8064AU–CNA
SnapdragonAPQ8076–CNA
SnapdragonAPQ8096AU–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8031–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA
SnapdragonMDM9150–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/march-2023-bulletin