8.4

CVE-2022-22071: Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CVSS: 8.4v3.1HighKEVAnalyzed
Published 14-06-2022Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2022-22071 is a high (CVSS 8.4) Use After Free vulnerability in Qualcomm Multiple Chipsets. It is known to be exploited: CISA lists it, first on 05-12-2023. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.41%
0%100%
Low · -0.04 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 14-06-2022
    PublishedVulnerability first disclosed.
  2. 05-12-2023
    Added to CISA KEVQualcomm Multiple Chipsets Use-After-Free Vulnerability
  3. 26-12-2023
    CISA remediation dueApply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

34%

Versus all other CVEs

30-day change

-0.04 pp

From 0.46% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.41%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
05-12-2023
Federal due date
26-12-2023

CISA required action

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2022-22071

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Qualcomm90 products
Qualcomm, inc.1 product
  • snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & musicAPQ8053, AR8031, AR8035, CSRA6620, CSRA6640, MDM9150, MSM8953, QCA6174A, QCA6390, QCA6391, QCA6426, QCA6436, QCA6574, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCA9377, QCM2290, QCM4290, QCM6490, QCS2290, QCS405, QCS410, QCS4290, QCS610, QCS6490, QRB5165, QRB5165M, QRB5165N, Qualcomm215, SA6155P, SA8155P, SA8195P, SD439, SD460, SD480, SD662, SD680, SD690 5G, SD695, SD750G, SD765, SD765G, SD768G, SD778G, SD780G, SD855, SD865 5G, SD870, SD888 5G, SDX12, SDX55, SDX55M, SDX65, SDXR2 5G, SM4125, SM7250P, SM7325P, WCD9326, WCD9335, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WCN3615, WCN3660B, WCN3680B, WCN3910, WCN3950, WCN3980, WCN3988, WCN3991, WCN3998, WCN3999, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WCN7850, WCN7851, WSA8810, WSA8815, WSA8830, WSA8835

2 vendors · 91 products

References

2 links