CVE-2022-38216
An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds writes, potentially crashing the Mapbox process.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- mapbox/maps software development kit
- Source
- cve-assign@fb.com
References
- https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1Release Notes, Third Party Advisory
- https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1Release Notes, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.