Vulnerability record · CVE-2022-32894 · published 24 August 2022
CVE-2022-32894: Apple iOS, iPadOS and macOS kernel out-of-bounds write
Apple · Ipados
An out-of-bounds write in Apple's kernel was addressed with improved bounds checking in iOS 15.6.1, iPadOS 15.6.1 and macOS Monterey 12.5.1. Apple states it is aware of a report that this issue may have been actively exploited, so unpatched devices are at real risk.
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with confirmed active exploitation and allows kernel-level code execution, though it requires local access and user interaction.
What it is
An out-of-bounds write in Apple's kernel was addressed with improved bounds checking in iOS 15.6.1, iPadOS 15.6.1 and macOS Monterey 12.5.1. Apple states it is aware of a report that this issue may have been actively exploited, so unpatched devices are at real risk.
Impact
A malicious application can execute arbitrary code with kernel privileges, giving full control of the device. This bypasses the normal application sandbox and undermines OS integrity.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker needs code running on the device and must convince the user to trigger it. It is not remotely reachable without that local foothold.
Exploitation
CVE-2022-32894 is listed in CISA KEV with a due date of 2022-09-08, and Apple confirms a report of active exploitation. EPSS 30-day probability is about 3.3 percent (87.8th percentile), and no ransomware campaign use is documented.
What to do
- Update to iOS 15.6.1, iPadOS 15.6.1 or macOS Monterey 12.5.1 (or later) immediately; these are the fixed versions named by Apple.
- Apply the equivalent watchOS update referenced in Apple advisories if the device is in scope.
- Enforce a minimum OS version policy on managed Apple devices and block or flag devices below the fixed versions.
- Restrict users from installing applications from untrusted sources and reduce exposure to untrusted content that could trigger the flaw.
- Monitor Apple security advisories for follow-up patches covering the same kernel component.
Detection
- Inventory Apple devices and report those running iOS/iPadOS below 15.6.1 or macOS below 12.5.1.
- Alert on unexpected kernel-level crashes or panics on Apple endpoints, which can accompany out-of-bounds write exploitation.
- Hunt for unusual processes gaining kernel or root-level privileges outside normal system activity.
- Correlate endpoint telemetry with known exploitation indicators from vendor and third-party advisories for this CVE.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-32894 to the Known Exploited Vulnerabilities catalog on 18 August 2022 as "Apple iOS and macOS Out-of-Bounds Write Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 8 September 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-32894 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-32894), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
