CVE-2022-25669 [High] | Out-of-bounds Read in Apq8009 Firmware

Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.50%	0.38%	-0.12%
2	2026-01-07	0.26%	0.50%	+0.24%
3	2026-01-06	—	0.26%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.50%

0.38%

-0.12%

2026-01-07

0.26%

0.50%

+0.24%

2026-01-06

—

0.26%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	3.6	[email protected]
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

3.6

[email protected]

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

3.6

[email protected]

Affected software / configurations for CVE-2022-25669

Vendor	Product	Version	Raw CPE
qualcomm	apq8009_firmware	—	cpe:2.3:o:qualcomm:apq8009_firmware:-:::::::*
qualcomm	apq8009w_firmware	—	cpe:2.3:o:qualcomm:apq8009w_firmware:-:::::::*
qualcomm	apq8053_firmware	—	cpe:2.3:o:qualcomm:apq8053_firmware:-:::::::*
qualcomm	apq8096au_firmware	—	cpe:2.3:o:qualcomm:apq8096au_firmware:-:::::::*
qualcomm	aqt1000_firmware	—	cpe:2.3:o:qualcomm:aqt1000_firmware:-:::::::*
qualcomm	ar8031_firmware	—	cpe:2.3:o:qualcomm:ar8031_firmware:-:::::::*
qualcomm	csra6620_firmware	—	cpe:2.3:o:qualcomm:csra6620_firmware:-:::::::*
qualcomm	csra6640_firmware	—	cpe:2.3:o:qualcomm:csra6640_firmware:-:::::::*
qualcomm	mdm9206_firmware	—	cpe:2.3:o:qualcomm:mdm9206_firmware:-:::::::*
qualcomm	mdm9250_firmware	—	cpe:2.3:o:qualcomm:mdm9250_firmware:-:::::::*
qualcomm	mdm9607_firmware	—	cpe:2.3:o:qualcomm:mdm9607_firmware:-:::::::*
qualcomm	mdm9626_firmware	—	cpe:2.3:o:qualcomm:mdm9626_firmware:-:::::::*
qualcomm	mdm9628_firmware	—	cpe:2.3:o:qualcomm:mdm9628_firmware:-:::::::*
qualcomm	mdm9650_firmware	—	cpe:2.3:o:qualcomm:mdm9650_firmware:-:::::::*
qualcomm	msm8909w_firmware	—	cpe:2.3:o:qualcomm:msm8909w_firmware:-:::::::*
qualcomm	msm8953_firmware	—	cpe:2.3:o:qualcomm:msm8953_firmware:-:::::::*
qualcomm	msm8996au_firmware	—	cpe:2.3:o:qualcomm:msm8996au_firmware:-:::::::*
qualcomm	qca4020_firmware	—	cpe:2.3:o:qualcomm:qca4020_firmware:-:::::::*
qualcomm	qca6174a_firmware	—	cpe:2.3:o:qualcomm:qca6174a_firmware:-:::::::*
qualcomm	qca6310_firmware	—	cpe:2.3:o:qualcomm:qca6310_firmware:-:::::::*
qualcomm	qca6320_firmware	—	cpe:2.3:o:qualcomm:qca6320_firmware:-:::::::*
qualcomm	qca6335_firmware	—	cpe:2.3:o:qualcomm:qca6335_firmware:-:::::::*
qualcomm	qca6390_firmware	—	cpe:2.3:o:qualcomm:qca6390_firmware:-:::::::*
qualcomm	qca6391_firmware	—	cpe:2.3:o:qualcomm:qca6391_firmware:-:::::::*
qualcomm	qca6420_firmware	—	cpe:2.3:o:qualcomm:qca6420_firmware:-:::::::*
qualcomm	qca6426_firmware	—	cpe:2.3:o:qualcomm:qca6426_firmware:-:::::::*
qualcomm	qca6430_firmware	—	cpe:2.3:o:qualcomm:qca6430_firmware:-:::::::*
qualcomm	qca6436_firmware	—	cpe:2.3:o:qualcomm:qca6436_firmware:-:::::::*
qualcomm	qca6564_firmware	—	cpe:2.3:o:qualcomm:qca6564_firmware:-:::::::*
qualcomm	qca6564a_firmware	—	cpe:2.3:o:qualcomm:qca6564a_firmware:-:::::::*
qualcomm	qca6564au_firmware	—	cpe:2.3:o:qualcomm:qca6564au_firmware:-:::::::*
qualcomm	qca6574_firmware	—	cpe:2.3:o:qualcomm:qca6574_firmware:-:::::::*
qualcomm	qca6574a_firmware	—	cpe:2.3:o:qualcomm:qca6574a_firmware:-:::::::*
qualcomm	qca6574au_firmware	—	cpe:2.3:o:qualcomm:qca6574au_firmware:-:::::::*
qualcomm	qca6595au_firmware	—	cpe:2.3:o:qualcomm:qca6595au_firmware:-:::::::*
qualcomm	qca6696_firmware	—	cpe:2.3:o:qualcomm:qca6696_firmware:-:::::::*
qualcomm	qca9367_firmware	—	cpe:2.3:o:qualcomm:qca9367_firmware:-:::::::*
qualcomm	qca9377_firmware	—	cpe:2.3:o:qualcomm:qca9377_firmware:-:::::::*
qualcomm	qca9379_firmware	—	cpe:2.3:o:qualcomm:qca9379_firmware:-:::::::*
qualcomm	qcm4290_firmware	—	cpe:2.3:o:qualcomm:qcm4290_firmware:-:::::::*
qualcomm	qcm6490_firmware	—	cpe:2.3:o:qualcomm:qcm6490_firmware:-:::::::*
qualcomm	qcs405_firmware	—	cpe:2.3:o:qualcomm:qcs405_firmware:-:::::::*
qualcomm	qcs410_firmware	—	cpe:2.3:o:qualcomm:qcs410_firmware:-:::::::*
qualcomm	qcs4290_firmware	—	cpe:2.3:o:qualcomm:qcs4290_firmware:-:::::::*
qualcomm	qcs603_firmware	—	cpe:2.3:o:qualcomm:qcs603_firmware:-:::::::*
qualcomm	qcs605_firmware	—	cpe:2.3:o:qualcomm:qcs605_firmware:-:::::::*
qualcomm	qcs610_firmware	—	cpe:2.3:o:qualcomm:qcs610_firmware:-:::::::*
qualcomm	qcs6490_firmware	—	cpe:2.3:o:qualcomm:qcs6490_firmware:-:::::::*
qualcomm	qualcomm215_firmware	—	cpe:2.3:o:qualcomm:qualcomm215_firmware:-:::::::*
qualcomm	sa6145p_firmware	—	cpe:2.3:o:qualcomm:sa6145p_firmware:-:::::::*
qualcomm	sa6155_firmware	—	cpe:2.3:o:qualcomm:sa6155_firmware:-:::::::*
qualcomm	sa6155p_firmware	—	cpe:2.3:o:qualcomm:sa6155p_firmware:-:::::::*
qualcomm	sa8155_firmware	—	cpe:2.3:o:qualcomm:sa8155_firmware:-:::::::*
qualcomm	sa8155p_firmware	—	cpe:2.3:o:qualcomm:sa8155p_firmware:-:::::::*
qualcomm	sa8195p_firmware	—	cpe:2.3:o:qualcomm:sa8195p_firmware:-:::::::*
qualcomm	sd_636_firmware	—	cpe:2.3:o:qualcomm:sd_636_firmware:-:::::::*
qualcomm	sd_675_firmware	—	cpe:2.3:o:qualcomm:sd_675_firmware:-:::::::*
qualcomm	sd_8_gen1_5g_firmware	—	cpe:2.3:o:qualcomm:sd_8_gen1_5g_firmware:-:::::::*
qualcomm	sd429_firmware	—	cpe:2.3:o:qualcomm:sd429_firmware:-:::::::*
qualcomm	sd439_firmware	—	cpe:2.3:o:qualcomm:sd439_firmware:-:::::::*
qualcomm	sd460_firmware	—	cpe:2.3:o:qualcomm:sd460_firmware:-:::::::*
qualcomm	sd480_firmware	—	cpe:2.3:o:qualcomm:sd480_firmware:-:::::::*
qualcomm	sd660_firmware	—	cpe:2.3:o:qualcomm:sd660_firmware:-:::::::*
qualcomm	sd662_firmware	—	cpe:2.3:o:qualcomm:sd662_firmware:-:::::::*
qualcomm	sd670_firmware	—	cpe:2.3:o:qualcomm:sd670_firmware:-:::::::*
qualcomm	sd675_firmware	—	cpe:2.3:o:qualcomm:sd675_firmware:-:::::::*
qualcomm	sd678_firmware	—	cpe:2.3:o:qualcomm:sd678_firmware:-:::::::*
qualcomm	sd680_firmware	—	cpe:2.3:o:qualcomm:sd680_firmware:-:::::::*
qualcomm	sd690_5g_firmware	—	cpe:2.3:o:qualcomm:sd690_5g_firmware:-:::::::*
qualcomm	sd710_firmware	—	cpe:2.3:o:qualcomm:sd710_firmware:-:::::::*
qualcomm	sd720g_firmware	—	cpe:2.3:o:qualcomm:sd720g_firmware:-:::::::*
qualcomm	sd730_firmware	—	cpe:2.3:o:qualcomm:sd730_firmware:-:::::::*
qualcomm	sd750g_firmware	—	cpe:2.3:o:qualcomm:sd750g_firmware:-:::::::*
qualcomm	sd765_firmware	—	cpe:2.3:o:qualcomm:sd765_firmware:-:::::::*
qualcomm	sd765g_firmware	—	cpe:2.3:o:qualcomm:sd765g_firmware:-:::::::*
qualcomm	sd768g_firmware	—	cpe:2.3:o:qualcomm:sd768g_firmware:-:::::::*
qualcomm	sd778g_firmware	—	cpe:2.3:o:qualcomm:sd778g_firmware:-:::::::*
qualcomm	sd780g_firmware	—	cpe:2.3:o:qualcomm:sd780g_firmware:-:::::::*
qualcomm	sd835_firmware	—	cpe:2.3:o:qualcomm:sd835_firmware:-:::::::*
qualcomm	sd845_firmware	—	cpe:2.3:o:qualcomm:sd845_firmware:-:::::::*

References for CVE-2022-25669

URL	Tags
https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin	Vendor Advisory

URL

CVE-2022-25669

Exploit prediction scoring system (EPSS) score for CVE-2022-25669

Common vulnerability scoring system (CVSS) metrics for CVE-2022-25669

Weakness enumeration for CVE-2022-25669

Affected software / configurations for CVE-2022-25669

References for CVE-2022-25669