Critical severity · published Aug 17, 2022
CVE-2022-23747
In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback
9.8
CVSS
10.2%
EPSS
No
On KEV
Description
In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
X1
Xperia 1 Firmware · Sony
All versions, or not specified · source: NVD
X5
Xperia 5 Firmware · Sony
All versions, or not specified · source: NVD
XP
Xperia Pro Firmware · Sony
All versions, or not specified · source: NVD