CVE-2022-26447: Critical severity Google Android vulnerability
In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2022-09-05 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS06784478
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26447?
The severity of CVE-2022-26447 is critical with a CVSS score of 9.8.
How can CVE-2022-26447 be exploited?
CVE-2022-26447 can be exploited remotely without user interaction, leading to potential remote code execution.
Which software products are affected by CVE-2022-26447?
Google Android versions 10.0, 11.0, and 12.0, as well as Yoctoproject Yocto 3.1, are affected by CVE-2022-26447.
Is the Mediatek Mt6580 vulnerable to CVE-2022-26447?
No, the Mediatek Mt6580 is not vulnerable to CVE-2022-26447.
How can I fix CVE-2022-26447?
To fix CVE-2022-26447, apply the patch ID ALPS06784478 provided by the vendor.