CVE-2022-20472

Deeper analysis

CVE-2022-20472 is an out-of-bounds read vulnerability in the toLanguageTag function of LocaleListCache.cpp, caused by an incorrect bounds check. The flaw affects multiple versions of Android, specifically Android-10 through Android-13, and carries the internal identifier A-239210579. It is tracked under CWE-125 and received a CVSS 3.1 base score of 9.8.

An attacker can exploit the issue over the network without authentication or user interaction to read memory beyond intended bounds, which may enable remote code execution with no additional privileges required. The vulnerability resides in a core system component, allowing potential compromise of affected devices simply by supplying malicious input that triggers the faulty locale handling path.

The December 2022 Android security bulletin addresses the issue through platform updates that correct the bounds check in LocaleListCache.cpp. Devices running the listed Android versions should be updated to the patched releases distributed by Google and device manufacturers.

EPSS for this CVE rose from a low baseline to a peak of 0.4485 on 2025-12-11 before receding to the current value of 0.0454, indicating a clear post-disclosure increase in observed exploitation interest.