CVE-2022-22579

HIGH

iPadOS < 15.3 - Information Disclosure and Arbitrary Code Execution via STL File Processing

Title source: llm
STIX 2.1

Description

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, tvOS 15.3, Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. Processing a maliciously crafted STL file may lead to unexpected application termination or arbitrary code execution.

References (5)

Core 5
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213055
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213053
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213054
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213056
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213057

Scores

CVSS v3 7.8
EPSS 0.0169
EPSS Percentile 74.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (6)
apple/ipados < 15.3
apple/iphone_os < 15.3
apple/mac_os_x 10.15.7 (12 CPE variants)
apple/mac_os_x < 10.15.7
apple/macos < 11.6.3
apple/tvos < 15.3
Published Mar 18, 2022
Tracked Since Feb 18, 2026