CVE-2022-40539

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption in Automotive Android OS due to improper validation of array index.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-129

Affected software

VendorProductVersions
Qualcomm, Inc.SnapdragonQAM8295P; QCA6574AU; QCA6696; QCC5100; QCS410; QCS610; SA6145P; SA6150P; SA6155P; SA8145P; SA8150P; SA8155P; SA8195P; SA8295P; SW5100; SW5100P; WCD9341; WCD9370; WCN3950; WCN3980
qualcommqam8295p_firmware<= *
qualcommqca6574au_firmware<= *
qualcommqca6696_firmware<= *
qualcommqcc5100_firmware<= *
qualcommqcs410_firmware<= *
qualcommqcs610_firmware<= *
qualcommsa6145p_firmware<= *
qualcommsa6150p_firmware<= *
qualcommsa6155p_firmware<= *
qualcommsa8145p_firmware<= *
qualcommsa8150p_firmware<= *
qualcommsa8155p_firmware<= *
qualcommsa8195p_firmware<= *
qualcommsa8295p_firmware<= *
qualcommsw5100_firmware<= *
qualcommsw5100p_firmware<= *
qualcommwcd9341_firmware<= *
qualcommwcd9370_firmware<= *
qualcommwcn3950_firmware<= *
qualcommwcn3980_firmware<= *
qualcommwcn3988_firmware<= *
qualcommwsa8810_firmware<= *
qualcommwsa8815_firmware<= *
qualcommwsa8830_firmware<= *
qualcommwsa8835_firmware<= *

References

Timeline

Published
Mar 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-40545.5An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5CVE-2022-405407.8Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.CVE-2022-40557.4When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to tCVE-2022-40575.3The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.CVE-2022-40585.4The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS cCVE-2022-40599.8The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement vCVE-2022-40609.8The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to anyCVE-2022-406029.8A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an imprCVE-2022-406036.1A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firCVE-2022-406047.5In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.CVE-2022-406056.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thCVE-2022-406066.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th
CVE-2022-40539: High severity, CVSS 7.8 | Vulnix