CVE-2022-43703
Incomplete verification of installation file signature
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Record
CVE-2022-43703- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
CVE List No score
Incomplete verification of installation file signature
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Record
CVE-2022-43703- Weakness
- CWE-427
- Updated
- 2026-11-02
EUVDEUVD-2022-46685 No score
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Record
EUVD-2022-46685- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hpg6-hp9w-vxqp
An installer that loads or executes files using an unconstrained search path may be vulnerable to...
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Record
GHSA-hpg6-hp9w-vxqp- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
Affected products
- arm development studio
- arm ds development studio
- arm ltd compiler 5 (ac5), arm compiler for embedded 6 (ac6), fast models (fm), arm compiler for embedded fusa (acef), arm development studio (ads), arm forge (af), arm mobile studio (ams), ds-5 development studio, fast models (fm), gnu toolchain (gt), keil mdk (kmdk), mbed studio (ms)
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43703 is a high vulnerability (CVSS 7.8) in Arm Development Studio, published July 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.