CVE-2022-32886

HIGH

Safari < 16.0 - Out-of-bounds Write via Malicious Web Content

Title source: llm
STIX 2.1

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.

References (13)

Core 13
Core References
Mailing List, Third Party Advisory vendor-advisory
https://www.debian.org/security/2022/dsa-5240
Mailing List, Third Party Advisory vendor-advisory
https://www.debian.org/security/2022/dsa-5241
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/09/msg00034.html
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/Oct/41
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213442
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213445
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213446

Scores

CVSS v3 8.8
EPSS 0.0074
EPSS Percentile 73.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-787
Status published
Products (8)
apple/ipados < 15.7
apple/iphone_os < 15.7
apple/safari < 16.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 35
fedoraproject/fedora 36
fedoraproject/fedora 37
Published Sep 20, 2022
Tracked Since Feb 18, 2026