CVE-2022-38216

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-16 · updated 2026-06-17
Weakness: CWE-190

Description

An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds writes, potentially crashing the Mapbox process.

Affected products

Mapbox Maps Software Development Kit: before 10.6.1 — fixed in 10.6.1

How to fix

Upgrade to a fixed version: Mapbox Maps Software Development Kit 10.6.1. Check the vendor advisory for mitigations.

References

https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1
https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1

Get alerted when CVE-2022-38216 or the next vulnerability affects your stack