CVE-2022-26465: 
NixOS vulnerability analysis and mitigation

CVE-2022-26465 is a vulnerability discovered in MediaTek's audio ipi component that was disclosed in September 2022. The vulnerability affects various MediaTek chipsets used in Android and Yocto-based devices, including MT6779, MT6781, MT6785, and several other models. This security flaw was identified as a medium severity issue involving improper input validation (Vendor Advisory).

The vulnerability stems from an out-of-bounds write condition due to an incorrect bounds check in the audio ipi component. It has been assigned a CVSS v3.1 base score of 6.7 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

If exploited, this vulnerability could lead to local escalation of privilege with System execution privileges. The successful exploitation could allow an attacker to gain elevated system privileges on affected devices (Vendor Advisory).

MediaTek has addressed this vulnerability by releasing security patches. The fix was included in the September 2022 security bulletin, and device OEMs were notified of the issues and corresponding security patches at least two months before publication (Vendor Advisory).