CVE-2022-40503 Buffer over-read in Bluetooth Host.
An attacker can read sensitive memory during A2DP streaming due to a buffer over-read in the Bluetooth Host on Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40503?
CVE-2022-40503 is a high-severity vulnerability in Qualcomm Apq8017 Firmware, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Which versions are affected by CVE-2022-40503?
It affects 185 products.
Products include Qualcomm 8905 Firmware, Qualcomm 8909 Firmware, Qualcomm 8953 Firmware, Qualcomm 8953pro Firmware, Qualcomm 9206 Lte Modem Firmware, Qualcomm Apq5053-Aa Firmware and 179 more.
How do I fix CVE-2022-40503?
Apply the vendor's patch.
Is CVE-2022-40503 being exploited?
There is no known exploitation of CVE-2022-40503 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8017 Firmware
Sources
Also known as 3237187, A-258057241, ASB-A-258057241, GHSA-h95q-46mc-6g3w.