HIGH

CVE-2022-32894

Apple Ipados 2022-08-24 CVSS v3.1

CVSS

7.8

KEV

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Summary dbcve.org

An out-of-bounds write vulnerability in the kernel of iOS, iPadOS, and macOS that allows a malicious application to execute arbitrary code with kernel-level privileges. This memory corruption bug was being actively exploited as a zero-day before Apple released patches in iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1.

Mitigation

Immediately apply the available security updates (iOS 15.6.1+, iPadOS 15.6.1+, macOS 12.5.1+) to all affected devices. Given active exploitation, priority should be given to patching internet-facing and high-value assets.

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

3.29%

Probability of exploitation in next 30 days

88th percentile

References

http://seclists.org/fulldisclosure/2022/Aug/16 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/45 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/49 Mailing List, Third Party Advisory https://support.apple.com/en-us/HT213412 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213413 Release Notes, Vendor Advisory https://support.apple.com/kb/HT213443 Third Party Advisory https://support.apple.com/kb/HT213486 Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32894 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE