CVE-2022-32894KEV · OVERDUE

Apple iOS and macOS Out-of-Bounds Write Vulnerability

High · published August 24, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 88.4th percentile for exploit probability.

1507
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
88.4
In the wild
Confirmed
What it is

🚨 An out-of-bounds write vulnerability could grant attackers kernel-level access! That’s like giving a stranger the master key to your entire house! 🔥 Think of it like a restaurant without proper checks on how many guests can be seated. If the waiter doesn't keep track, they might let in way too many diners, leading to chaos and overflowing plates everywhere! In this case, if exploited, an attacker could execute arbitrary code with the highest privileges possible on the system. This means they could potentially take control of your device, access sensitive data, or even install malicious software without your knowledge. Absolutely devastating!

Put simply

Think of it like a restaurant without proper checks on how many guests can be seated. If the waiter doesn't keep track, they might let in way too many diners, leading to chaos and overflowing plates everywhere! This out-of-bounds write issue occurs when the application fails to properly check memory limits, allowing attackers to overwrite portions of memory that should not be accessible. It's a classic case of the system not knowing where its boundaries are!

What to do

In this case, if exploited, an attacker could execute arbitrary code with the highest privileges possible on the system. This means they could potentially take control of your device, access sensitive data, or even install malicious software without your knowledge. Absolutely devastating! To protect yourself, update your devices immediately to iOS 15.6.1, iPadOS 15.6.1, or macOS Monterey 12.5.1. If you're managing devices in a corporate environment, ensure all users are aware of this update and prioritize it in your IT maintenance schedule. You've got this! Stay vigilant and keep your devices updated, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03286 · 88.4th percentile
Published
2022-08-24T00:00Z
KEV added
2022-08-18 · due 2022-09-08
EPSS history
Timeline
  • 24 AUG 00:00Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5
  • 18 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 8
    kev