Vulnerabilities > CVE-2022-36938 - Improper Validation of Specified Quantity in Input vulnerability in Facebook Redex
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |