CVE-2022-22071
Published 2022-06-14 · Updated 2026-06-17 · Source product-security@qualcomm.com
Summary
CVE-2022-22071 is a high-severity (CVSS 8.4) vulnerability in Qualcomm Multiple Chipsets. CISA added it to the Known Exploited Vulnerabilities catalog on December 5, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 26, 2023. CISA does not currently list it as used in ransomware campaigns. Qualcomm has 12 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 12 known-exploited Qualcomm vulnerabilities →Description
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Qualcomm — Multiple Chipsets
Name: Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Date added: 2023-12-05 · Due: 2023-12-26
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.