Actively exploited in the wild

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Qualcomm - Multiple Chipsets · Listed in the CISA KEV since 2023-12-05. This indicates confirmed attacks in production environments.

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

CVE-2022-22071

HighCVSS 8.4KEV

Published: 14/06/2022(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress. This affects Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music.

Risk Assessment

The vulnerability could lead to arbitrary code execution or system crash, posing a risk of device compromise. Organizations using affected Snapdragon platforms are at risk.

Recommendation

Apply updates from the vendor for affected Snapdragon platforms. Monitor devices for unusual behavior.

Other vulnerabilities in Qualcomm Snapdragon

CVE-2020-11261HighActively exploited
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables.

Original NVD description (English source)

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music