Read the docs
TI-2022-21460 Aliases CVE-2022-43703GHSA-hpg6-hp9w-vxqp

Incomplete verification of installation file signature

Priority LOW 33CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.

Why it matters now

EPSS 0.00194 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArmArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later—No fix listedCNA
  • Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) VendorArm Affected AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:*5.0.0 – 5.29.3VulnerableArm
  • cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.29.3 Vulnerable ·Arm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43703
  2. 2026-10-03 Alias added: GHSA-hpg6-hp9w-vxqp

References

Advisory 1

Other 1

  • TI-2022-21459 Incomplete verification of installation file signature CVSS 3.1HIGH 7.8
  • TI-2022-21458 Insecure directory permissions on installer files CVSS 3.1HIGH 7.8
  • TI-2025-06768 Uncontrolled search path in Arm Development Studio CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences