CVE-2022-38216: Mapbox is vulnerable to Integer Overflow
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.26968%
CWE
Published
8/17/2022
Updated
2/3/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
com.mapbox.mapboxsdk:mapbox-android-core | maven | < 10.6.1 | 10.6.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability exists in Mapbox's closed-source gl-native library, whose source code and commit diffs are not publicly available. While the description indicates the issue occurs when processing large image dimensions during image creation, the lack of accessible code makes it impossible to identify specific function names
or file paths
with high confidence. The Android SDK's patch notes reference a fix in dependencies (gl-native v10.6.1
) but provide no implementation details. Without access to the proprietary library's codebase, we can only infer that functions
handling image allocation/validation
are involved, but cannot definitively name them.