{"id":"CVE-2022-36938","details":"DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.","modified":"2026-08-12T13:33:10.814886Z","published":"2022-11-10T00:00:00Z","database_specific":{"cna_assigner":"facebook","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36938.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3b44c64"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36938.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36938"},{"type":"FIX","url":"https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/redex","events":[{"introduced":"0"},{"fixed":"3b44c640346b77bfb7ef36e2413688dd460288d2"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36938.json","vanir_signatures_modified":"2026-08-12T13:33:10Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2","target":{"file":"libredex/DexLoader.cpp"},"deprecated":false,"digest":{"line_hashes":["177910661925181941752688148644438945393","249220321442325309033942983871564946740","187854720454391115907995214234916729570","104253921962812185286245934959302245729","181986475796517449553315829491872791399","314879030129633176182008407230254154162","95845696118994499748079908062571616971","165383393234662988824599750142236456709","337006233898131201948608113667587183889","320276635355040413562090943046278799634","191126501076420063077693187672972407318"],"threshold":0.9},"id":"CVE-2022-36938-b64dfaa4","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"292464291331006992722555593385468323157","length":1039},"id":"CVE-2022-36938-d3c57609","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2","target":{"file":"libredex/DexLoader.cpp","function":"validate_dex_header"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}