What is CVE-2022-26527?

CVE-2022-26527 is a medium-severity vulnerability in Google Android, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2022-08-30.

How severe is CVE-2022-26527?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-26527 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Google Android

CVE-2022-26527

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Google Android
Linux Linux_kernel
Realtek Bluetooth_mesh_software_development_kit
Realtek Linux/android Bluetooth Mesh Sdk — versions unspecified

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

References

twcert@cert.org.tw (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-26527?: CVE-2022-26527 is a medium-severity vulnerability in Google Android, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2022-08-30.
How severe is CVE-2022-26527?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-26527 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.