CVE-2022-48618: Apple OS Pointer Authentication Bypass via TOCTOU Race Condition

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation against older iOS, but it requires an existing local read/write primitive, which limits reachability.

What it is

A time-of-check time-of-use race condition in Apple's pointer authentication implementation allows an attacker who already holds arbitrary read and write capability to bypass pointer authentication. Apple states it is aware of a report that this issue may have been exploited against iOS versions released before 15.7.1. The flaw affects macOS, iOS, iPadOS, watchOS and tvOS and was fixed in macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, watchOS 9.2 and tvOS 16.2.

Impact

An attacker with existing arbitrary read and write access can defeat pointer authentication, removing a key control-flow integrity defense and enabling further memory corruption or code execution. The bypass itself does not grant initial access; it escalates what an already-positioned attacker can do.

Attack surface

The CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction (UI:N), so the flaw is reached by code already running on the device rather than over the network. Authentication is required in the sense that the attacker must already have a foothold with read/write primitives.

Exploitation

CVE-2022-48618 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2024-01-31), and Apple states it may have been exploited against iOS before 15.7.1. EPSS is low at roughly 0.49% for 30 days, and no ransomware campaign use is documented.

What to do

• Update to macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, watchOS 9.2 or tvOS 16.2, or later, per Apple advisories HT213530, HT213532, HT213535 and HT213536.
• Treat any device still running iOS or iPadOS before 15.7.1 as potentially compromised and prioritize it for patching and review.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product where mitigations are unavailable.
• Restrict the ability of untrusted code to run on managed Apple devices and enforce a minimum OS version through MDM.

Detection

• Inventory Apple endpoints and flag any macOS, iOS, iPadOS, watchOS or tvOS build below the fixed versions listed in the Apple advisories.
• Hunt for exploitation indicators on devices that ran iOS before 15.7.1, focusing on unexpected process memory access or code-injection behavior.
• Monitor for post-exploitation activity consistent with pointer authentication bypass, such as abnormal control-flow or memory corruption crashes on Apple devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.