Use after free in Trusted Application Environment
Priority LOW 35CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
Memory corruption due to use after free in trusted application environment.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00122 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon | APQ8096AU; MDM9628; MSM8996AU; QCA6390; QCA6391; QCA6426; QCA6436; QCA6564A; QCA6564AU; QCA6574A; QCA6574AU; Qualcomm215; SD205; SD210; SD429; SD865 5G; SD870; SDM429W; SDX55M; SDXR2 5G; WCD9340; WCD9380; WCN3610; WCN3620; WCN3660B; WCN6850; WCN6851; WSA8810; WSA8815 | — | No fix listed | CNA |
- Snapdragon VendorQualcomm Affected APQ8096AU; MDM9628; MSM8996AU; QCA6390; QCA6391; QCA6426; QCA6436; QCA6564A; QCA6564AU; QCA6574A; QCA6574AU; Qualcomm215; SD205; SD210; SD429; SD865 5G; SD870; SDM429W; SDX55M; SDXR2 5G; WCD9340; WCD9380; WCN3610; WCN3620; WCN3660B; WCN6850; WCN6851; WSA8810; WSA8815 Fixed in — No fix listed CNA
CPE configurations NVD · 58
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Show 48 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd205:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd429:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd205:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd429:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-33225
- 2026-10-03 Alias added: GHSA-w2p5-vj22-45fp
More Qualcomm Apq8096au Firmware vulnerabilities
- TI-2021-01605 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
- TI-2020-09124 Improper input validation in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… KEVCVSS 3.1HIGH 7.8
- TI-2021-01606 Improper handling of address deregistration on failure can lead to new GPU address… KEVCVSS 3.1MEDIUM 6.2
- TI-2020-03185 Buffer overflow in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… CVSS 3.1CRITICAL 9.8
- TI-2020-09127 Improper authentication in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.8
- TI-2020-09163 Improper authentication in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2022-33225 · CVE Program
- CVE-2022-33225 · NVD
- FIRST EPSS
- GHSA-w2p5-vj22-45fp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences