Apple · iOS
CVE-2022-42856
Apple iOS Type Confusion Vulnerability
What it is
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CISA: Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: January 4, 2023
- Added to the CISA list
- December 14, 2022
- Published
- December 15, 2022
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 8.5% in the top 5.0% of all known vulnerabilities
- Weakness
- CWE-843
- More details
- NVD · CVE.org · CISA
All references (12)
- https://support.apple.com/en-us/HT213535
- https://support.apple.com/en-us/HT213532
- https://support.apple.com/en-us/HT213531
- https://support.apple.com/en-us/HT213516
- https://support.apple.com/en-us/HT213537
- http://seclists.org/fulldisclosure/2022/Dec/21
- http://seclists.org/fulldisclosure/2022/Dec/23
- http://seclists.org/fulldisclosure/2022/Dec/22
- http://seclists.org/fulldisclosure/2022/Dec/26
- http://seclists.org/fulldisclosure/2022/Dec/28
- http://www.openwall.com/lists/oss-security/2022/12/26/1
- https://security.gentoo.org/glsa/202305-32
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 24, 2022 | Information Disclosure | iOS | Medium 5.5 | 33% |
| May 24, 2022 | Memory Corruption | iOS | High 7.8 | 24% |
| May 24, 2022 | Webkit Memory Corruption | iOS | High 8.8 | 67% |
| May 23, 2022 | Memory Corruption | iOS | High 7.8 | 4.6% |
| Nov 3, 2021 | WebKit Buffer Overflow | iOS | High 8.8 | 3.0% |
| Nov 3, 2021 | WebKit Memory Corruption | iOS | High 8.8 | 11% |
| Nov 3, 2021 | WebKit Use-After-Free | iOS | High 8.8 | 11% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.