CVE-2022-22675KEV · OVERDUE

Apple macOS Out-of-Bounds Write Vulnerability

High · published May 26, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 96.2th percentile for exploit probability.

1643
days past CISA
deadline
CVSS v3.1
7.8
EPSS
12%
Percentile
96.2
In the wild
Confirmed
What it is

⚠️ An out-of-bounds write is more than just a coding hiccup — it lets attackers execute arbitrary code with kernel privileges! 🚨 This vulnerability is like an unscrupulous hotel contractor who ignores the blueprints, allowing unauthorized access to the back rooms where valuables are stored. If unchecked, a clever attacker could create a hidden entrance right into the heart of your system's operations. The potential consequences are absolutely devastating. An attacker can gain full control over the affected device, leading to data breaches, unauthorized access to sensitive information, or even a complete takeover of the system!

Put simply

This vulnerability is like an unscrupulous hotel contractor who ignores the blueprints, allowing unauthorized access to the back rooms where valuables are stored. If unchecked, a clever attacker could create a hidden entrance right into the heart of your system's operations. This out-of-bounds write flaw occurs when an application writes data outside the intended buffer, allowing attackers to manipulate memory and execute malicious code with elevated privileges.

What to do

The potential consequences are absolutely devastating. An attacker can gain full control over the affected device, leading to data breaches, unauthorized access to sensitive information, or even a complete takeover of the system! To protect against this vulnerability, update your devices to the latest versions: tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1, and iPadOS 15.4.1. Regularly check for updates and consider implementing additional security measures to monitor for unauthorized access. You've got this! With these updates, you'll be one step closer to securing your devices and keeping those digital villains at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.12492 · 96.2th percentile
Published
2022-05-26T17:44Z
KEV added
2022-04-04 · due 2022-04-25
EPSS history
Timeline
  • 26 MAY 17:44Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5
  • 04 APR 00:00Z
    Added to CISA KEV — remediate by Apr 25
    kev