CVE-2022-32893: Apple WebKit out-of-bounds write allows code execution via crafted web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with only user interaction, is listed in CISA KEV with confirmed in-the-wild exploitation, and affects widely deployed Apple and Linux WebKit platforms.

What it is

An out-of-bounds write in WebKit was fixed by improved bounds checking in iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1 and Safari 15.6.1. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited. The same WebKit flaw also affects WebKitGTK and WPE WebKit packages shipped by Debian, Fedora and Gentoo.

Impact

An attacker who gets a victim to load crafted web content can execute arbitrary code in the context of the browser or WebKit-based application, giving full compromise of confidentiality, integrity and availability on the affected device.

Attack surface

Reached over the network by delivering malicious web content to a WebKit-based browser or application; the CVSS vector shows no privileges required but user interaction is required, so the victim must open or view the crafted content.

Exploitation

Apple stated the issue may have been actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation due date of 2022-09-08. EPSS gives a 30-day exploitation probability of about 9.9 percent (95th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor updates immediately: iOS/iPadOS 15.6.1, macOS Monterey 12.5.1 and Safari 15.6.1, per Apple advisories HT213412, HT213413 and HT213414.
• Update WebKitGTK and WPE WebKit packages on Debian, Fedora and Gentoo using the referenced distribution advisories.
• Where patching cannot be completed at once, restrict browsing to trusted sites and reduce use of WebKit-based clients on affected hosts.
• Track remediation against the CISA KEV due date of 2022-09-08 and confirm all managed Apple devices and Linux WebKit packages are on fixed versions.

Detection

• Hunt for crashes or abnormal terminations in WebKit-based processes (Safari, WebKit content processes, WebKitGTK/WPE applications) that coincide with browsing activity.
• Monitor for unexpected child processes or code execution spawned from browser or WebKit processes, which would indicate successful exploitation.
• Review web proxy and DNS logs for access to suspicious or newly registered domains around the time of reported browser crashes.
• Verify patch state of Apple devices and Linux WebKit packages against the fixed versions to identify unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.