Exploitation Summary
CVE-2022-22675 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 4, 2022.
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
References (6)
Core 6
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213256
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213220
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213219
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213253
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213254
Third Party Advisory, US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22675
Scores
CVSS v3
7.8
EPSS
0.0144
EPSS Percentile
81.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2022-04-04
VulnCheck KEV
2022-03-31
InTheWild.io
2022-03-31
ENISA EUVD
EUVD-2022-27820
CWE
CWE-787
Status
published
Products (5)
apple/ipados
< 15.4.1
apple/iphone_os
< 15.4.1
apple/macos
11.0 - 11.6.6
apple/tvos
< 15.5
apple/watchos
< 8.6
Published
May 26, 2022
KEV Added
Apr 04, 2022
Tracked Since
Feb 18, 2026