CVE-2022-25708

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-257097.8Memory corruption in modem due to use of out of range pointer offset while processing qmi msgCVE-2022-25717.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.CVE-2022-257107.5Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustriCVE-2022-257117.8Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdCVE-2022-257127.8Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOCVE-2022-257137.8Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key.CVE-2022-257157.8Memory corruption in display driver due to incorrect type casting while accessing the fence structure fieldsCVE-2022-257167.0Memory corruption in Multimedia Framework due to unsafe access to the data membersCVE-2022-257177.8Memory corruption in display due to double free while allocating frame buffer memoryCVE-2022-257189.8Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon ConnectivityCVE-2022-257199.1Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon ConnectCVE-2022-25729.8In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys
CVE-2022-25708: Critical severity, CVSS 9.8 | Vulnix