CVE-2022-46693

HIGH

Apple tvOS, macOS, iOS, watchOS, and iCloud - Code Execution via Crafted File

Title source: manual
STIX 2.1

Description

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a maliciously crafted file may lead to arbitrary code execution.

References (9)

Core 9
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213530
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213532
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213535
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213536
Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213538
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/Dec/20
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/Dec/23
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/Dec/26

Scores

CVSS v3 7.8
EPSS 0.0027
EPSS Percentile 50.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-787
Status published
Products (6)
apple/icloud < 14.1
apple/ipados < 16.2
apple/iphone_os < 16.2
apple/macos < 13.1
apple/tvos < 16.2
apple/watchos < 9.2
Published Dec 15, 2022
Tracked Since Feb 18, 2026