CVE-2022-32917: Apple iOS, iPadOS and macOS out-of-bounds write in kernel

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKernel-privilege code execution with confirmed in-the-wild exploitation and CISA KEV listing, though it requires local code execution and no ransomware use is documented.

What it is

An out-of-bounds write (CWE-787) in Apple's kernel was addressed with improved bounds checks in macOS Monterey 12.6, macOS Big Sur 11.7, iOS 15.7/iPadOS 15.7 and iOS 16. A local application can trigger the flaw to execute arbitrary code with kernel privileges, and Apple states it is aware of a report that the issue may have been actively exploited.

Impact

An attacker who can run code on the device gains kernel-level code execution, effectively full control of the operating system and its protections.

Attack surface

The CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction (UI:N), so the flaw is reached by a malicious or compromised application already running on the device rather than over the network.

Exploitation

CVE-2022-32917 is listed in CISA KEV with a remediation due date of 2022-10-05, and Apple acknowledges a report of active exploitation; EPSS 30-day probability is about 5.6 percent (92.5th percentile). No ransomware campaign use is documented.

What to do

• Update to the fixed releases: macOS Monterey 12.6, macOS Big Sur 11.7, iOS 15.7/iPadOS 15.7 or iOS 16, per Apple advisories HT213443 through HT213446.
• Prioritize patching for devices exposed to untrusted or sideloaded applications, and enforce a minimum OS version for managed fleets.
• Restrict installation of applications to trusted sources and review mobile device management policies that allow untrusted app distribution.
• Monitor Apple security advisories for follow-up fixes, since this class of kernel memory corruption often recurs across releases.

Detection

• Hunt for unexpected kernel panics or crashes on Apple endpoints, which can accompany out-of-bounds write exploitation.
• Review endpoint telemetry for unusual processes gaining kernel-level activity or loading unexpected kernel extensions.
• Check asset inventories against the fixed OS versions to find unpatched iPhones, iPads and Macs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.