CVE-2022-35858: Samsung Mtower

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.

Affected products

• Samsung Mtower: version 0.3.0 only

Published 2022-08-04. Last modified 2026-06-17.