How severe is CVE-2022-22265?

CVE-2022-22265 has a CVSS 3.1 base score of 5 (MEDIUM). EPSS estimates a 0.4% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2022-22265: Samsung Mobile Devices Use-After-Free

CISA Known Exploited Vulnerabilities

Samsung Mobile Devices Use-After-Free Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2023-09-18

Remediation due

2023-10-09

Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA notes
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://nvd.nist.gov/vuln/detail/CVE-2022-22265

Description

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

Severity

CVSS 3.1 · CNA5 MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Samsung Mobile	Samsung Mobile Devices	O(8.x), P(9.0), Q(10.0), R(11.0), S(12.0) to <SMR Jan-2022 Release 1

References

1 Links

Other references

https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1

Record Details

Published

2022-01-07

Last updated

2025-10-21

Assigner (CNA)

Samsung Mobile

Credited to

More from Samsung Mobile

CVE-2025-210428.8

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

CVE-2021-253374.4

Samsung Mobile Devices Improper Access Control Vulnerability

CVE-2023-214924.4

Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

CVE-2025-210438.8

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-703 · Improper Check of Exceptional Conditions

Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.