Apple · iOS, iPadOS, and macOS
CVE-2022-32917
Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
What it is
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CISA: Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: October 5, 2022
- Added to the CISA list
- September 14, 2022
- Published
- September 20, 2022
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 5.6% in the top 7.1% of all known vulnerabilities
- Weakness
- CWE-20 CWE-787
- More details
- NVD · CVE.org · CISA
All references (8)
- https://support.apple.com/en-us/HT213446
- https://support.apple.com/en-us/HT213443
- https://support.apple.com/en-us/HT213445
- https://support.apple.com/en-us/HT213444
- http://seclists.org/fulldisclosure/2022/Oct/39
- http://seclists.org/fulldisclosure/2022/Oct/40
- http://seclists.org/fulldisclosure/2022/Oct/43
- http://seclists.org/fulldisclosure/2022/Oct/45
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2025 | Out-of-Bounds Write | iOS, iPadOS, and macOS | Critical 10.0 | 65% |
| Sep 11, 2023 | ImageIO Buffer Overflow | iOS, iPadOS, and macOS | High 7.8 | 53% |
| Apr 10, 2023 | IOSurfaceAccelerator Out-of-Bounds Write | iOS, iPadOS, and macOS | High 8.6 | 23% |
| Mar 30, 2023 | Out-of-Bounds Write | iOS, iPadOS, and macOS | High 7.8 | 5.2% |
| Sep 8, 2022 | Input Validation | iOS, iPadOS, and macOS | Medium 5.5 | 3.2% |
| Feb 11, 2022 | Webkit Use-After-Free | iOS, iPadOS, and macOS | High 8.8 | 16% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.7% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.0% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.