CVE-2022-3349: Sony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflow

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-28 · updated 2026-06-17
Weakness: CWE-119

Description

A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679.

Affected products

Sony Playstation 4 Firmware: all versions
Sony Playstation 5 Firmware: all versions

References

https://hackerone.com/reports/1340942
https://vuldb.com/?id.209679
https://hackerone.com/reports/1340942
https://vuldb.com/?id.209679

Get alerted when CVE-2022-3349 or the next vulnerability affects your stack