PatchTheCVECVE-2022-26431: In mailbox, there is a possible out of bounds write due to a missing bounds check
CVE-2022-26431 is a medium-severity flaw (CVSS 6.7) affecting android, yocto. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032553; Issue ID: ALPS07032553.
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.7 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2022-08-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-26431?
android: mitigate or apply the listed mitigation; yocto: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2022-26431 being exploited?
CVE-2022-26431 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-26431 affect?
CVE-2022-26431 affects android, yocto. Severity is medium (CVSS 6.7). In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0703
How urgent is CVE-2022-26431?
Priority 24/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2023-20627 MEDIUM 6.7 MITIGATE In pqframework, there is a possible out of bounds write due to a missing bounds check
- CVE-2023-21435 MEDIUM 4.4 MITIGATE Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attac
- CVE-2026-21009 MEDIUM 6.8 MITIGATE Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker
- CVE-2026-21003 MEDIUM 6.8 MITIGATE Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physi
- CVE-2026-21007 MEDIUM 6.8 MITIGATE Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attac