CVE-2022-22265
Google Android 10.0 … 9.0
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:LSummary
CVE-2022-22265 is a medium-severity Improper Check or Handling of Exceptional Conditions (CWE-703) vulnerability in Google Android. Its CVSS base score is 5.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 32th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an improper check or handling of exceptional conditions, tracked as CWE-703, in the NPU driver prior to Samsung's SMR Jan-2022 Release 1. It permits arbitrary memory writes that can lead to code execution on affected devices. The issue carries a CVSS 3.1 base score of 5.0 reflecting local attack vector, high attack complexity, low privileges, and required user interaction.
A local attacker who already has a foothold on the device can trigger the flaw through crafted inputs to the NPU driver, achieving limited but scoped impacts on confidentiality, integrity, and availability. Exploitation requires user interaction and does not yield full system compromise under the published scoring.
Samsung's January 2022 security bulletin addresses the issue in the SMR Jan-2022 Release 1 update. The CVE is also listed in CISA's Known Exploited Vulnerabilities catalog, confirming real-world exploitation activity. The EPSS score rose from a low baseline to a recorded peak of 0.0104, indicating increased exploitation interest after public disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27412
Vulnerability Data
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
- CWE(s)
- KEV Date Added
- 18 September 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Implements explicit check and handling for the exceptional condition of audit logging process failure.
Establishing and monitoring system metrics with correlation and response actions helps identify and address improper handling of exceptional conditions.
Provides a defined response to detected conditions by restricting operation, ensuring exceptional conditions are handled rather than ignored or mishandled.
Contingency training equips users with defined procedures to check and respond to exceptional conditions during disruptions, reducing exploitation of mishandled errors.
Testing verifies the system's ability to detect, handle, and recover from exceptional conditions as part of the plan, reducing exploitability of improper exception handling.
Regular updates keep contingency procedures aligned with system changes, providing structured handling for exceptional conditions that would otherwise allow unmitigated exploitation.
Policy defines checks and handling for exceptional conditions arising from security incidents.
Performing IR tests ensures exceptional conditions are properly checked and handled to enable effective response.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require anticipating and correctly handling exceptional conditions during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reporting of unhandled errors or exceptional conditions surfaces latent failure paths so they can be corrected before exploitation.