What is CVE-2022-26528?

CVE-2022-26528 is a medium-severity vulnerability in Google Android, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2022-08-30.

How severe is CVE-2022-26528?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-26528 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Google Android

CVE-2022-26528

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Google Android
Linux Linux_kernel
Realtek Bluetooth_mesh_software_development_kit
Realtek Linux/android Bluetooth Mesh Sdk — versions unspecified

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

References

twcert@cert.org.tw (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-26528?: CVE-2022-26528 is a medium-severity vulnerability in Google Android, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2022-08-30.
How severe is CVE-2022-26528?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-26528 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.