CVE-2022-20412: In fdt_next_tag of fdt.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-230794395

CSIRTS triage

What: Out-of-bounds read in fdt_next_tag due to incorrect bounds checking allows escalation of privilege.
Who is affected: Android 10 and 11 devices; requires system execution privileges but no user interaction.
Urgency: High priority; privilege escalation with system-level access demonstrates critical exposure.
Action: Apply the Android security patch addressing CVE-2022-20412 to affected devices.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Android

Get an email when a new Android advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2022-204120.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2022-20412	coverage & exploitation status	NVD · CVE.org