CVE-2022-22265
Samsung Mobile Devices Use-After-Free Vulnerability
Published Jan 10, 2022 · updated Jun 16, 2026 · google android
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Timeline
Detection, updates, and resolution for this record.
Jan 10, 2022 · Catalog
Detected
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Sep 18, 2023 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 9, 2023 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 9, 2023
Affected
- cpe google/android10.0
- cpe google/android11.0
- cpe google/android12.0
- cpe google/android9.0
- vendor Samsung Mobile Devicesversion unspecified
Sources
- CISA KEVCVE-2022-22265
Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.
cisa.gov - CVE.orgCVE-2022-22265
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-22265
30-day exploitation probability 0.4%
first.org - NIST NVDCVE-2022-22265
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
nvd.nist.gov