CVE-2022-42813

CRITICAL

iPadOS < 16.0 - Improper Certificate Validation in WKWebView

Title source: llm
STIX 2.1

Description

A certificate validation issue existed in the handling of WKWebView. This issue was addressed with improved validation. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. Processing a maliciously crafted certificate may lead to arbitrary code execution.

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.0071
EPSS Percentile 72.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-295
Status published
Products (5)
apple/ipados < 16.0
apple/iphone_os < 16.1
apple/macos < 13.0
apple/tvos < 16.1
apple/watchos < 9.1
Published Nov 01, 2022
Tracked Since Feb 18, 2026