CVE-2022-42827: Apple iOS and iPadOS out-of-bounds write allows kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives kernel-level code execution, is listed in CISA KEV with confirmed in-the-wild exploitation, and has a straightforward patch, though it requires local application execution and user interaction.

What it is

An out-of-bounds write in Apple iOS and iPadOS was fixed by improved bounds checking in iOS 15.7.1, iPadOS 15.7.1, iOS 16.1 and iPadOS 16. Apple states it is aware of a report that this issue may have been actively exploited. A malicious application can trigger the memory corruption to run arbitrary code with kernel privileges.

Impact

An attacker who gets a malicious application running on the device gains arbitrary code execution at kernel privilege, effectively full control of the operating system.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), so the flaw is reached by a locally running application, typically after the user opens or installs it; no remote or network vector is described.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-10-25, and Apple states it may have been actively exploited; EPSS 30-day probability is low at roughly 1 percent, and no ransomware use is documented.

What to do

• Update to iOS 15.7.1, iPadOS 15.7.1, iOS 16.1 or iPadOS 16 per Apple advisories HT213489 and HT213490.
• Enforce a minimum OS version on managed iPhones and iPads and block or flag devices below the fixed builds.
• Restrict installation of applications to trusted sources and review mobile device management allowlists.
• Treat this as a priority patch under the CISA KEV due date of 2022-11-15 and verify remediation.
• Monitor for unexpected kernel-level crashes or anomalous process behavior on unpatched devices.

Detection

• Inventory iOS and iPadOS versions and alert on any device still below 15.7.1 or 16.1.
• Review crash and diagnostic logs for kernel panics or out-of-bounds related faults on affected devices.
• Monitor for sideloaded or untrusted applications installed outside approved channels.
• Correlate mobile threat defense or EDR telemetry for suspicious code execution at kernel privilege.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.