Cyber Resilience

CVE-2022-25479

Medium

Published: 02 July 2024

Published
02 July 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0280 86.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-25479 is a medium-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Realtek Rtsper. Its CVSS base score is 5.5 (Medium).

Operationally, ranked in the top 13.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.

CWE(s)
CWE-401

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

realtek
rtsper
≤ 10.0.22000.21355
realtek
rtsuer
≤ 10.0.22000.31274

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References