CVE-2022-25738 Buffer Over-read in MODEM
A buffer over-read in the Qualcomm modem allows attackers to disclose sensitive information from memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25738?
CVE-2022-25738 is a high-severity vulnerability in Qualcomm Ar8031 Firmware, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure in modem due to buffer over-red while performing checksum of packet received
Which versions are affected by CVE-2022-25738?
It affects 35 products.
Products include Qualcomm Ar8031 Firmware, Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Mdm8207 Firmware, Qualcomm Mdm9205 Firmware, Qualcomm Mdm9206 Firmware and 29 more.
How do I fix CVE-2022-25738?
No fix has been published for CVE-2022-25738 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25738 being exploited?
There is no known exploitation of CVE-2022-25738 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Ar8031 Firmware
- CVE-2025-27038 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2022-25729 Improper Input Validation in MODEM
- CVE-2022-25727 Memory corruption in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
- CVE-2021-30285 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- CVE-2021-30275 Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Sources
Also known as GHSA-gj5q-vrv4-xj86.