CVE-2022-20203

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jun 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-202047.8In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a miss CVE-2022-202055.5In isFileUri of FileUtil.java, there is a possible way to bypass the check for a file:// scheme due to improper input validation. This could CVE-2022-202065.5In setPackageOrComponentEnabled of NotificationManagerService.java, there is a missing permission check. This could lead to local informatio CVE-2022-202077.8In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an insecure default value. This could lead to CVE-2022-202084.4In parseRecursively of cppbor_parse.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local i CVE-2022-202097.5In hme_add_new_node_to_a_sorted_array of hme_utils.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead CVE-2022-202109.8The UE and the EMM communicate with each other using NAS messages. When a new NAS message arrives from the EMM, the modem parses it and fill CVE-2022-202127.8In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to loc CVE-2022-202135.5In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local CVE-2022-202144.7In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button CVE-2022-202155.5In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to loc CVE-2022-202169.8android exported is used to set third-party app access permissions, and the default value of intent-filter is true. com.sprd.firewall has se