CVE-2022-25716 Time-of-check Time-of-use Race Condition in Multimedia Framework
A race condition in the Qualcomm Multimedia Framework allows memory corruption, potentially enabling code execution on affected Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25716?
CVE-2022-25716 is a medium-severity vulnerability in Qualcomm Sd888 5g Firmware, published on 6 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption in Multimedia Framework due to unsafe access to the data members
Weakness: CWE-367
Which versions are affected by CVE-2022-25716?
It affects 7 products.
Products include Qualcomm Sd888 5g Firmware, Qualcomm Wcd9380 Firmware, Qualcomm Wcd9385 Firmware, Qualcomm Wcn6850 Firmware, Qualcomm Wcn6851 Firmware, Qualcomm Wsa8830 Firmware and 1 more.
How do I fix CVE-2022-25716?
No fix has been published for CVE-2022-25716 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25716 being exploited?
There is no known exploitation of CVE-2022-25716 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Sd888 5g Firmware
Sources
Also known as GHSA-mw5v-w29j-c9g9.