CVE-2022-36938

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-36938

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36938.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-36938

Published

2022-11-10T00:00:00Z

Modified

2026-08-12T04:06:26.176842953Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

DexLoader function getstringidxfromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.

Database specific

{
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36938.json",
    "cna_assigner": "facebook",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "3b44c64"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/facebook/redex

Affected ranges

Type

GIT

Repo

https://github.com/facebook/redex

Events

Introduced

Fixed

3b44c640346b77bfb7ef36e2413688dd460288d2

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36938.json"