CVE-2022-22265Samsung Mobile Devices Use-After-Free Vulnerability

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

5.0 MEDIUMEPSS 0.41%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2025-10-21 23:15 UTC

OverviewCVSS details

5.0MEDIUMCVSS 3.1

Score source: Samsung Mobile (CNA)
NVD status: Published
Published: Jan 7, 2022
Assigner: Samsung Mobile

Affected

Samsung Mobile Devices (Samsung Mobile)

Versions: O(8.x), P(9.0), Q(10.0), R(11.0), S(12.0) before SMR Jan-2022 Release 1
Fixed in: SMR Jan-2022 Release 1

Exploitation

Public exploit: None listed
CISA KEV: Listed · Sep 18, 2023
KEV due date: Oct 9, 2023
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 6

0.41%chance of exploitation in 30 days

Higher than 36.32% of CVEs

CVSS 3.1 · Samsung Mobile (CNA)

5.0Medium

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: Required
Scope: Changed
Confidentiality impact: Low
Integrity impact: Low
Availability impact: Low

NVD status: Published

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
5.0	MEDIUM	3.1Samsung Mobile (CNA)	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Details

CVE ID: CVE-2022-22265
Status: Published
Assigner (CNA): Samsung Mobile
Published: Jan 7, 2022
Last modified: 2025-10-21 23:15 UTC
Weaknesses: CWE-703 · Improper Check or Handling of Exceptional Conditions

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-07 14:12 UTC.