CVE-2022-43702
Incomplete verification of installation file signature
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Record
CVE-2022-43702- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284, CWE-276
- Updated
- 2026-11-02
CVE List No score
Incomplete verification of installation file signature
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Record
CVE-2022-43702- Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2022-46684 No score
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Record
EUVD-2022-46684- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3h3-xh77-5fcf
When the directory containing the installer does not have sufficiently restrictive file...
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Record
GHSA-g3h3-xh77-5fcf- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276, CWE-284
- Updated
- 2026-11-02
Affected products
- arm compiler
- arm compiler for embedded fusa
- arm compiler for functional safety
- arm development studio
- arm ds development studio
- arm fast models
- arm ltd compiler 5 (ac5), arm compiler for embedded 6 (ac6), fast models (fm), arm compiler for embedded fusa (acef), arm development studio (ads), arm forge (af), arm mobile studio (ams), ds-5 development studio, fast models (fm), gnu toolchain (gt), keil mdk (kmdk), mbed studio (ms)
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43702 is a high vulnerability (CVSS 7.8) in Arm Compiler, published July 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.