CVE-2022-40539 — Improper Validation of Array Index in Automotive Android OS

Back Back to CVE browser

HIGH

Improper Validation of Array Index in Automotive Android OS

Published Mar 7, 2023

8.4

HIGH

CVSS 3.1

EPSS 0.13%

Description

Memory corruption in Automotive Android OS due to improper validation of array index.

Affected products

Vendor Qualcomm, Inc. Product Snapdragon Default
unaffected
- Version
  QAM8295P
  Status
  affected
  Constraints
  -
- Version
  QCA6574AU
  Status
  affected
  Constraints
  -
- Version
  QCA6696
  Status
  affected
  Constraints
  -
- Version
  QCC5100
  Status
  affected
  Constraints
  -
- Version
  QCS410
  Status
  affected
  Constraints
  -
- Version
  QCS610
  Status
  affected
  Constraints
  -
- Version
  SA6145P
  Status
  affected
  Constraints
  -
- Version
  SA6150P
  Status
  affected
  Constraints
  -
- Version
  SA6155P
  Status
  affected
  Constraints
  -
- Version
  SA8145P
  Status
  affected
  Constraints
  -
- Version
  SA8150P
  Status
  affected
  Constraints
  -
- Version
  SA8155P
  Status
  affected
  Constraints
  -
- Version
  SA8195P
  Status
  affected
  Constraints
  -
- Version
  SA8295P
  Status
  affected
  Constraints
  -
- Version
  SW5100
  Status
  affected
  Constraints
  -
- Version
  SW5100P
  Status
  affected
  Constraints
  -
- Version
  WCD9341
  Status
  affected
  Constraints
  -
- Version
  WCD9370
  Status
  affected
  Constraints
  -
- Version
  WCN3950
  Status
  affected
  Constraints
  -
- Version
  WCN3980
  Status
  affected
  Constraints
  -
- Version
  WCN3988
  Status
  affected
  Constraints
  -
- Version
  WSA8810
  Status
  affected
  Constraints
  -
- Version
  WSA8815
  Status
  affected
  Constraints
  -
- Version
  WSA8830
  Status
  affected
  Constraints
  -
- Version
  WSA8835
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Qualcomm, Inc.

Snapdragon

unaffected

Version	Status	Constraints
QAM8295P	affected	-
QCA6574AU	affected	-
QCA6696	affected	-
QCC5100	affected	-
QCS410	affected	-
QCS610	affected	-
SA6145P	affected	-
SA6150P	affected	-
SA6155P	affected	-
SA8145P	affected	-
SA8150P	affected	-
SA8155P	affected	-
SA8195P	affected	-
SA8295P	affected	-
SW5100	affected	-
SW5100P	affected	-
WCD9341	affected	-
WCD9370	affected	-
WCN3950	affected	-
WCN3980	affected	-
WCN3988	affected	-
WSA8810	affected	-
WSA8815	affected	-
WSA8830	affected	-
WSA8835	affected	-

Vendor Qualcomm Product Qam8295p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Qca6574au Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Qca6696 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Qcc5100 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Qcs410 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Qcs610 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa6145p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa6150p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa6155p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa8145p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa8150p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa8155p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa8195p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sa8295p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sw5100 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Sw5100p Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wcd9341 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wcd9370 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wcn3950 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wcn3980 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wcn3988 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wsa8810 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wsa8815 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wsa8830 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*
Vendor Qualcomm Product Wsa8835 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Qualcomm

Qam8295p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Qca6574au Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Qca6696 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Qcc5100 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Qcs410 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Qcs610 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa6145p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa6150p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa6155p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa8145p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa8150p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa8155p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa8195p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sa8295p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sw5100 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Sw5100p Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wcd9341 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wcd9370 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wcn3950 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wcn3980 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wcn3988 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wsa8810 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wsa8815 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wsa8830 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Qualcomm

Wsa8835 Firmware

n/a

Version	Status	Constraints
0	affected	<=*

Remediation

No remediation recorded yet.

Metrics

0.13% 0.00132

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00132

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (6 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.13% (0.00132)	2.33th	v5 (v2026.06.15)
Jun 15, 2026	0.13% (0.00132)	3.08th	v5 (v2026.06.15)
Mar 17, 2025	0.03% (0.00032)	5.93th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00044)	14.58th	v3 (v2023.03.01)
Jun 13, 2024	0.04% (0.00043)	8.98th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00043)	6.97th	v3 (v2023.03.01)

Weaknesses (2)

CWE-129

CWE-284

References (1)

https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin
Vendor Advisory

Link	Providers	Tags
https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner qualcomm

Published Mar 7, 2023

Updated Aug 3, 2024

Reserved Sep 12, 2022

Link CVE-2022-40539

CISA Vulnrichment

Updated Jul 11, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-40539

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-40539