CVE-2022-22587KEV · OVERDUE

Apple Memory Corruption Vulnerability

Critical · published March 18, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 96.0th percentile for exploit probability.

1716
days past CISA
deadline
CVSS v3.1
9.8
EPSS
12%
Percentile
96.0
In the wild
Confirmed
What it is

🚨 An unpatched memory corruption issue could allow a malicious app to run wild with kernel privileges! 🔥 Think of your device like a luxury hotel — if a rogue guest manages to get a master key, they can access any room, do anything, and even steal valuables. This vulnerability opens the door for attackers to exploit your system's most secure areas. With this vulnerability, a malicious application can execute arbitrary code at the kernel level, potentially compromising your entire system. Imagine an intruder gaining full access to your device, wiping data, or even hijacking your personal information — absolutely devastating!

Put simply

Think of your device like a luxury hotel — if a rogue guest manages to get a master key, they can access any room, do anything, and even steal valuables. This vulnerability opens the door for attackers to exploit your system's most secure areas. This memory corruption vulnerability arises from inadequate input validation, allowing a malicious application to execute harmful code with elevated privileges. Essentially, it can exploit system memory allocations to bypass security controls.

What to do

With this vulnerability, a malicious application can execute arbitrary code at the kernel level, potentially compromising your entire system. Imagine an intruder gaining full access to your device, wiping data, or even hijacking your personal information — absolutely devastating! To protect your devices, update immediately to iOS 15.3, iPadOS 15.3, macOS Big Sur 11.6.3, or macOS Monterey 12.2. Don't wait — ensure your system is running the latest software to close this critical exploit. You've got this! By updating your devices now, you're taking a big step toward keeping your digital world safe and secure. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11638 · 96.0th percentile
Published
2022-03-18T17:59Z
KEV added
2022-01-28 · due 2022-02-11
EPSS history
Timeline
  • 18 MAR 17:59Z
    A memory corruption issue was addressed with improved input validation
    cvelistv5
  • 28 JAN 00:00Z
    Added to CISA KEV — remediate by Feb 11
    kev