Vulnerability · Published Aug 17, 2022 · Assigned by checkpoint
CVE-2022-23747
Critical 9.8
In plain English
A critical-severity buffer overflow in Sony Xperia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)10.5%top 4.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Sony Xperia | series 1, 5, and Pro |
Weakness: CWE-120
References
- https://cpr-zero.checkpoint.com/vulns/cprid-2191/ x_refsource_MISC
- https://research.checkpoint.com/2022/bad-alac-one-codec-to-hack-the-whole-world/ x_refsource_MISC