Vulnerability record · CVE-2022-46689 · published 15 December 2022
CVE-2022-46689: Apple OS kernel race condition allows arbitrary code execution
Apple · Safari
A race condition in Apple's kernel was addressed with additional validation across iOS, iPadOS, macOS, tvOS and watchOS. An app can exploit the race to execute arbitrary code with kernel privileges, which is the highest level of access on the device. The flaw is fixed in the December 2022 updates, so unpatched devices remain exposed.
Description
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityKernel-level code execution with a high EPSS score and broad Apple device exposure, though it requires local app execution and user interaction and is not in KEV.
What it is
A race condition in Apple's kernel was addressed with additional validation across iOS, iPadOS, macOS, tvOS and watchOS. An app can exploit the race to execute arbitrary code with kernel privileges, which is the highest level of access on the device. The flaw is fixed in the December 2022 updates, so unpatched devices remain exposed.
Impact
An attacker who can run an app on the target device gains kernel-level code execution, effectively full control of the operating system and the ability to bypass security protections.
Attack surface
The vector is local (AV:L) with no privileges required (PR:N) but user interaction is required (UI:R), meaning the victim must run or interact with a malicious app. It is not remotely reachable without that local foothold.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is high at roughly 0.45 (98.7th percentile), indicating elevated predicted exploitation likelihood. References are vendor advisories and mailing lists only, with no public exploit tag.
What to do
- Apply the December 2022 Apple updates: iOS/iPadOS 16.2 and 15.7.2, macOS Ventura 13.1, Monterey 12.6.2, Big Sur 11.7.2, tvOS 16.2, watchOS 9.2.
- Enforce a minimum OS version policy on managed Apple devices and block or flag devices below the fixed builds.
- Restrict app installation to trusted sources and review app entitlements to reduce the chance of a malicious app being run.
- Monitor for and remove sideloaded or untrusted apps on managed endpoints.
Detection
- Inventory Apple devices and compare reported OS versions against the fixed builds to find unpatched endpoints.
- Alert on kernel-level crashes or panics that cluster around app launches, which can indicate race condition exploitation attempts.
- Monitor for unexpected processes gaining elevated or kernel-adjacent privileges after user app interaction.
- Track installation of sideloaded or non-approved apps on managed devices as a precursor to local exploitation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-46689 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-46689), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
