Vulnerability record · CVE-2022-22675 · published 26 May 2022
CVE-2022-22675: Apple kernel out-of-bounds write allows code execution
Apple · Ipados
An out-of-bounds write in Apple's kernel was fixed through improved bounds checking across tvOS, watchOS, macOS Big Sur, macOS Monterey, iOS and iPadOS. Apple states it is aware of a report that this issue may have been actively exploited, so unpatched Apple devices are at real risk.
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw gives kernel code execution, is listed in CISA KEV with confirmed active exploitation, and has a high EPSS percentile, though it requires local access and user interaction.
What it is
An out-of-bounds write in Apple's kernel was fixed through improved bounds checking across tvOS, watchOS, macOS Big Sur, macOS Monterey, iOS and iPadOS. Apple states it is aware of a report that this issue may have been actively exploited, so unpatched Apple devices are at real risk.
Impact
An attacker can execute arbitrary code with kernel privileges, giving full control of the affected device.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), meaning the attacker must get code running on the device and convince the user to trigger it, for example by opening crafted content. No remote network vector is described.
Exploitation
CVE-2022-22675 is listed in CISA KEV with a 2022-04-25 remediation due date, and Apple reports it may have been actively exploited; EPSS 30-day probability is about 12.5 percent (96th percentile). No ransomware use is documented.
What to do
- Apply the vendor updates: iOS 15.4.1, iPadOS 15.4.1, macOS Monterey 12.3.1, macOS Big Sur 11.6.6, tvOS 15.5 and watchOS 8.6.
- Prioritize patching internet-facing and executive or high-value Apple devices first, given known exploitation.
- Enforce a minimum OS version baseline for Apple endpoints and block or flag devices below the fixed releases.
- Restrict users from opening untrusted files or links on unpatched devices until they are updated.
Detection
- Inventory Apple devices and compare reported OS versions against the fixed releases to find unpatched endpoints.
- Monitor EDR or unified logs for unexpected kernel-level code execution or crashes on Apple endpoints.
- Hunt for suspicious processes spawned from user-triggered document or media handling on unpatched macOS, iOS and iPadOS devices.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-22675 to the Known Exploited Vulnerabilities catalog on 4 April 2022 as "Apple macOS Out-of-Bounds Write Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 25 April 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/HT213219 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213220 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213253 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213254 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213256 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213219 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213220 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213253 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213254 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT213256 | Release NotesVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22675 | Third Party AdvisoryUS Government Resource |
Track CVE-2022-22675 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-22675), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
