CVE-2022-22674: Apple macOS kernel out-of-bounds read leaks kernel memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing indicates known exploitation, but the local-only vector and medium CVSS score limit broad impact.

What it is

An out-of-bounds read in Apple macOS led to disclosure of kernel memory, fixed by improved input validation in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, and macOS Big Sur 11.6.6. Kernel memory disclosure matters because it can expose sensitive data and aid further exploitation of the kernel.

Impact

A local user can read kernel memory, potentially obtaining sensitive information that could be used to weaken kernel protections or plan further attacks.

Attack surface

The flaw is reached locally, as reflected by the CVSS vector AV:L, and requires low privileges (PR:L) with no user interaction (UI:N). No remote or network vector is described.

Exploitation

CVE-2022-22674 is listed in CISA KEV with a due date of 2022-04-25, indicating known exploitation, while EPSS is low at 0.01133 (64.8th percentile). References are vendor advisories and the CISA KEV entry; no public exploit details are provided.

What to do

• Apply the Apple security updates that fix this issue: macOS Monterey 12.3.1, Security Update 2022-004 Catalina, and macOS Big Sur 11.6.6.
• Prioritize patching systems where local users are untrusted or where kernel memory confidentiality is important.
• Restrict local login and administrative access to reduce exposure to local attackers.
• Monitor for and remove unapproved local software that could trigger the out-of-bounds read.

Detection

• Review endpoint logs for unusual local processes attempting to read kernel memory or crash reports tied to kernel memory access.
• Audit macOS versions against the fixed releases and flag unpatched hosts.
• Correlate local user activity with signs of kernel memory disclosure or post-exploitation behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.