Security readout for executives and security teams
Plain-English summary
CVE-2022-32619 is a MediaTek keyinstall flaw that can corrupt memory through an out-of-bounds write. It is not described as remotely exploitable. An attacker would need local, high-privilege execution, but successful exploitation could increase control over the device.
Executive priority
Treat this as a managed-device hygiene issue, not an emergency remote compromise. Prioritize patch verification for fleets with MediaTek Android devices, especially older or unsupported models that may have missed OEM security updates.
Technical view
The issue is CWE-787 in MediaTek keyinstall caused by an incorrect bounds check. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, scored 6.7. MediaTek lists many chipsets across Android 10, 11, 12, and 13, with patch ID ALPS07439659.
Likely exposure
Exposure is most likely in Android phones, tablets, or embedded Android devices using the listed MediaTek chipsets and running Android 10 through 13. Product exposure depends on OEM firmware contents and whether the December 2022 MediaTek security fixes were integrated.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not marked KEV. The flaw requires local access with high privileges and no user interaction, making it more relevant as a post-compromise privilege escalation risk than an initial intrusion vector.
Researcher notes
Evidence is limited to MediaTek and CVE records. The sources identify the component, weakness class, affected platforms, CVSS vector, and patch ID, but do not provide technical root-cause detail, public exploit status, or OEM-specific firmware mapping.
Mitigation direction
- Apply OEM firmware updates that include MediaTek December 2022 bulletin fixes.
- Prioritize affected MediaTek devices running Android 10 through 13.
- Check vendor guidance for patch ID ALPS07439659 availability.
- Restrict high-privilege local access on managed Android devices.
- Replace devices that no longer receive OEM security updates.
Validation and detection
- Inventory Android devices for listed MediaTek chipsets and OS versions.
- Confirm OEM firmware includes the December 2022 MediaTek security bulletin.
- Track ALPS07439659 in vendor or OEM release notes.
- Verify managed devices are still receiving security updates.
- Document exceptions where OEM patch status cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-32619 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H0.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://corp.mediatek.com/product-security-bulletin/December-2022CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.