CVE-2022-48503KEV · OVERDUE

Apple Multiple Products Unspecified Vulnerability

High · published August 14, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 88.1th percentile for exploit probability.

347
days past CISA
deadline
CVSS v3.1
8.8
EPSS
3%
Percentile
88.1
In the wild
Confirmed
What it is

🚨 A sneaky flaw in how web content is processed can lead to arbitrary code execution! With just the right web page, an attacker could take over your device. 🔥 Think of this as a restaurant where the cook blindly follows any recipe handed to them without checking the ingredients. If someone slipped in a toxic ingredient, it would be disastrous! An attacker could exploit this vulnerability to run any kind of code on your device, potentially accessing sensitive information, corrupting files, or even taking complete control of your system. This could lead to a catastrophic breach of your personal data and security. Yikes!

Put simply

Think of this as a restaurant where the cook blindly follows any recipe handed to them without checking the ingredients. If someone slipped in a toxic ingredient, it would be disastrous! CVE-2022-48503 stems from inadequate bounds checks when processing web content, allowing for arbitrary code execution, which means an attacker can run malicious code on affected devices.

What to do

An attacker could exploit this vulnerability to run any kind of code on your device, potentially accessing sensitive information, corrupting files, or even taking complete control of your system. This could lead to a catastrophic breach of your personal data and security. Yikes! To protect yourself, upgrade your devices to the latest versions: tvOS 15.6, watchOS 8.7, iOS 15.6, iPadOS 15.6, macOS Monterey 12.5, and Safari 15.6. Don't wait—ensure your devices are secure now! You've got this! With a quick update, you can keep your devices safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03213 · 88.1th percentile
Published
2023-08-14T22:40Z
KEV added
2025-10-20 · due 2025-11-10
EPSS history
Timeline
  • 20 OCT 00:00Z
    Added to CISA KEV — remediate by Nov 10
    kev
  • 14 AUG 22:40Z
    The issue was addressed with improved bounds checks
    cvelistv5