Read the docs
TI-2022-13261 Aliases CVE-2022-31222GHSA-9r29-9qmj-8m4x

Memory leak in Dell CPG BIOS

Priority LOW 20CWE-401Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-401.

Summary

Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash.

Why it matters now

EPSS 0.00179 7th percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 21Q4 platforms

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 21Q4 platforms21Q4 platformsPatch availableCNA
  • CPG BIOS VendorDell Affected before 21Q4 platforms Fixed in 21Q4 platforms Patch available CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:chengming_3900:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_14_plus_7420_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:inspiron_14_plus_7420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_16_plus_7620_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:inspiron_16_plus_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3910_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:inspiron_3910:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5320_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableDell
cpe:2.3:h:dell:inspiron_5320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:chengming_3900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_14_plus_7420_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_14_plus_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_16_plus_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_16_plus_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3910_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5320_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:inspiron_5420_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_5420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5620_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_5620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7420_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableDell
cpe:2.3:h:dell:inspiron_7420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7620_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableDell
cpe:2.3:h:dell:inspiron_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3000_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:optiplex_3000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3000_thin_client_firmware:*:*:*:*:*:*:*:*before 1.0.7VulnerableDell
cpe:2.3:h:dell:optiplex_3000_thin_client:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_5000_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_5000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_5400_firmware:*:*:*:*:*:*:*:*before 1.0.13VulnerableDell
cpe:2.3:h:dell:optiplex_5400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7000_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_7000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7000_oem_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_7000_oem:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7400_firmware:*:*:*:*:*:*:*:*before 1.0.13VulnerableDell
cpe:2.3:h:dell:optiplex_7400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3460_small_form_factor_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:precision_3460_small_form_factor:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3660_tower_firmware:*:*:*:*:*:*:*:*before 1.3.71VulnerableDell
cpe:2.3:h:dell:precision_3660_tower:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_5770_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:precision_5770:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3710_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:vostro_3710:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3910_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:vostro_3910:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5320_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableDell
cpe:2.3:h:dell:vostro_5320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5620_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:vostro_5620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_7620_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:vostro_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:xps_17_9720_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:xps_17_9720:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:inspiron_5420_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5620_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7420_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3000_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3000_thin_client_firmware:*:*:*:*:*:*:*:* Versions before 1.0.7 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3000_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_5000_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_5400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.13 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_5400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7000_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7000_oem_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7000_oem:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.13 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3460_small_form_factor_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3460_small_form_factor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3660_tower_firmware:*:*:*:*:*:*:*:* Versions before 1.3.71 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3660_tower:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_5770_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_5770:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3710_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3910_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5320_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5620_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:xps_17_9720_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:xps_17_9720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 21Q4 platforms

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell CPG BIOS 21Q4 platforms

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2022-13265 Stack-based buffer overflow in Dell CPG BIOSPriority LOW 33
    • TI-2022-13264 Dell BIOS versions contain an Unchecked Return Value vulnerability.Priority LOW 22
    • TI-2022-13259 Dell BIOS versions contain an Unchecked Return Value vulnerability.Priority LOW 22
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31222
  2. 2026-10-03 Alias added: GHSA-9r29-9qmj-8m4x

References

Patch 1

  • TI-2024-35208 Weak authentication in Dell Client Platform BIOS CVSS 3.1HIGH 8.2
  • TI-2023-23082 Link following in Dell Client Platform, Dell Dock Firmware CVSS 3.1HIGH 7.3
  • TI-2022-13265 Stack-based buffer overflow in Dell CPG BIOS CVSS 3.1HIGH 7.8
  • TI-2025-21364 Stack-based buffer overflow in Dell Client Platform BIOS CVSS 3.1MEDIUM 6.9
  • TI-2023-12655 Time-of-check time-of-use race condition in Dell CPG BIOS CVSS 3.1MEDIUM 6.9
  • TI-2024-00146 Improper input validation in Dell CPG BIOS CVSS 3.1MEDIUM 6.7
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences