← Vulnerability feed

Vulnerability record · CVE-2022-22265 · published 10 January 2022

CVE-2022-22265: Samsung NPU driver improper exception handling enables memory write and code execution

Google · Android

The NPU driver in Samsung Android devices mishandles exceptional conditions, allowing arbitrary memory writes and code execution. The flaw was fixed in the SMR Jan-2022 Release 1 and is listed in CISA KEV, so it has been exploited in the wild. It matters because a local attacker can gain code execution in a privileged driver context on unpatched devices.

7.8 CVSS 3.1 High CISA KEV since 18 Sep 2023 EPSS 0.39% · top 69.3% CWE-703 · CWE-703
7.8CVSS 3.1 base score, v2 4.6
0.39%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows local code execution and is confirmed exploited in CISA KEV, but requires local access and low privileges, and EPSS probability is low.

What it is

The NPU driver in Samsung Android devices mishandles exceptional conditions, allowing arbitrary memory writes and code execution. The flaw was fixed in the SMR Jan-2022 Release 1 and is listed in CISA KEV, so it has been exploited in the wild. It matters because a local attacker can gain code execution in a privileged driver context on unpatched devices.

Impact

An attacker gains arbitrary memory write and code execution, which can lead to privilege escalation and full compromise of the device. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by a local app or process already running on the device. No remote or network path is described.

Exploitation

CVE-2022-22265 is in CISA KEV (added 2023-09-18), confirming known exploitation, though EPSS 30-day probability is low at 0.00392 (33rd percentile). No ransomware campaign use is documented.

What to do

  • Apply the SMR Jan-2022 Release 1 or later firmware from Samsung for affected devices.
  • If patching is not possible, follow CISA's required action to apply vendor mitigations or discontinue use of the product.
  • Restrict installation of untrusted apps and limit local code execution paths on unpatched devices.
  • Track device fleet patch levels and prioritize any device still on pre-Jan-2022 SMR firmware.

Detection

  • Monitor for anomalous NPU driver activity or crashes in kernel logs on Samsung Android devices.
  • Alert on local processes attempting unusual memory operations or privilege escalation attempts targeting the NPU driver.
  • Correlate device firmware/SMR version against the Jan-2022 baseline to find unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2022-22265 to the Known Exploited Vulnerabilities catalog on 18 September 2023 as "Samsung Mobile Devices Use-After-Free Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 9 October 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1 Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22265 US Government Resource

Track CVE-2022-22265 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed

Source: NIST National Vulnerability Database (record CVE-2022-22265), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.