{"schema":"threatline.record/2","record":{"id":"CVE-2022-22071","aliases":[],"summary":"Qualcomm Multiple Chipsets Use-After-Free Vulnerability","details":"Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.","categories":["Unclassified"],"product":"Multiple Chipsets","vendor":"Qualcomm","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-22071","source_modified_at":"2025-10-21T23:15:38.616Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music","vendor":"Qualcomm, Inc.","versions":[{"status":"affected","version":"APQ8053, AR8031, AR8035, CSRA6620, CSRA6640, MDM9150, MSM8953, QCA6174A, QCA6390, QCA6391, QCA6426, QCA6436, QCA6574, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCA9377, QCM2290, QCM4290, QCM6490, QCS2290, QCS405, QCS410, QCS4290, QCS610, QCS6490, QRB5165, QRB5165M, QRB5165N, Qualcomm215, SA6155P, SA8155P, SA8195P, SD439, SD460, SD480, SD662, SD680, SD690 5G, SD695, SD750G, SD765, SD765G, SD768G, SD778G, SD780G, SD855, SD865 5G, SD870, SD888 5G, SDX12, SDX55, SDX55M, SDX65, SDXR2 5G, SM4125, SM7250P, SM7325P, WCD9326, WCD9335, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WCN3615, WCN3660B, WCN3680B, WCN3910, WCN3950, WCN3980, WCN3988, WCN3991, WCN3998, WCN3999, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WCN7850, WCN7851, WSA8810, WSA8815, WSA8830, WSA8835"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.4,"severity":"High","kev":{"listed":true,"date_added":"2023-12-05","due_date":"2023-12-26","required_action":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.00411,"percentile":0.34203,"score_date":"2026-10-23"},"published_at":"2022-06-14T09:51:15.000Z","modified_at":"2025-10-21T23:15:38.616Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2022-22071","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:15:38.616Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22071","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22071","source":"CISA KEV"},{"source":"CVE List","url":"https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22071","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2023-12-07T05:00:06.692752Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-10-21T23:15:38.616Z","content_hash":"25a37acdb0cb994888f8d57f8037d5ebf19fcae7b605307c918100d081687b2c"}}