CVE-2022-22675
Published 2022-05-26 · Updated 2026-06-17 · Source product-security@apple.com
Summary
CVE-2022-22675 is a high-severity (CVSS 7.8) vulnerability in Apple macOS. CISA added it to the Known Exploited Vulnerabilities catalog on April 4, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 25, 2022. CISA does not currently list it as used in ransomware campaigns. Apple has 95 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 95 known-exploited Apple vulnerabilities →Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apple — macOS
Name: Apple macOS Out-of-Bounds Write Vulnerability
Date added: 2022-04-04 · Due: 2022-04-25
Required action: Apply updates per vendor instructions.
References
- https://support.apple.com/en-us/HT213219
- https://support.apple.com/en-us/HT213220
- https://support.apple.com/en-us/HT213253
- https://support.apple.com/en-us/HT213254
- https://support.apple.com/en-us/HT213256
- https://support.apple.com/en-us/HT213219
- https://support.apple.com/en-us/HT213220
- https://support.apple.com/en-us/HT213253