CVE-2022-22105

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music	APQ8009, APQ8017, APQ8053, APQ8096AU, AR8031, CSRA6620, CSRA6640, CSRB31024, MDM9150, MDM9250, MDM9607, MDM9626, MDM9628, MDM9640, MDM9650, QCA4020, QCA6174A, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584, QCA6595, QCA6595AU, QCA6696, QCA9367, QCA9377, QCA9379, QCS405, SA415M, SA515M, SA6155, SA6155P, SA8155, SA8155P, SA8195P, SDX20, SDX55, WCD9326, WCD9335, WCD9360, WCN3610, WCN3615, WCN3660B, WCN3680B, WCN3980, WCN3998, WCN3999, WSA8810, WSA8815

References

https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletinVendor Advisory

Timeline

Published: Sep 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221067.8Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto CVE-2022-221074.3In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (e CVE-2022-221084.3In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (e CVE-2022-221095.4In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users CVE-2022-22116.5A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys()CVE-2022-221107.5In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to u CVE-2022-221118.8In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permissio CVE-2022-221125.4In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged CVE-2022-221138.8In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed b CVE-2022-221149.6In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not s CVE-2022-221159.0In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is CVE-2022-221165.4In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in m