{"id":"CVE-2022-32893","published":"2022-08-24T20:15:09Z","modified":"2026-06-17T04:48:09Z","title":"Apple iOS and macOS Out-of-Bounds Write Vulnerability","vendor":"Apple","product":"iOS and macOS","tier":"core","eol":null,"description":{"text":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","provenance":"source","from":"NVD"},"summary":{"text":"An out-of-bounds write flaw in Apple's iOS, iPadOS, macOS and Safari web content handling, which Apple addressed with improved bounds checking. An attacker who can get a victim to process maliciously crafted web content over the network, with no authentication required but with the victim's user interaction, can achieve arbitrary code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:01Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.09931,"percentile":0.95578,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-08-18","dueDate":"2022-09-08","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413;  https://nvd.nist.gov/vuln/detail/CVE-2022-32893","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-17","exploitedFirstSeen":"2022-08-17","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-08-17"},{"url":"https://support.apple.com/kb/HT213412","date":"2022-08-17"},{"url":"https://support.apple.com/kb/HT213413","date":"2022-08-17"},{"url":"https://support.apple.com/kb/HT213414","date":"2022-08-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-18"},{"url":"https://support.apple.com/kb/HT213428","date":"2022-08-31"},{"url":"https://support.apple.com/kb/HT213486","date":"2022-09-12"},{"url":"https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf","date":"2023-01-17"},{"url":"https://intel471.com/blog/macos-is-increasingly-targeted-by-threat-actors","date":"2024-08-12"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://seclists.org/fulldisclosure/2022/Aug/16","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/49","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/25/5","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/26/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/29/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/29/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/10","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/13/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00019.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SETAAXEPGNBMYKTUDFEZHS5LGSQ64QL/","tags":["Broken Link"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKJGV2EXVMYQW3OAJNI4WUTKKVMD2YYK/","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202208-39","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/en-us/HT213412","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213413","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213414","tags":["Vendor Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5219","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5220","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Aug/16","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/49","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/25/5","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/26/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/29/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/29/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/10","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/13/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00019.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SETAAXEPGNBMYKTUDFEZHS5LGSQ64QL/","tags":["Broken Link"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKJGV2EXVMYQW3OAJNI4WUTKKVMD2YYK/","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202208-39","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/en-us/HT213412","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213413","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213414","tags":["Vendor Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5219","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5220","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32893","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious web content delivered to victim browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Processing maliciously crafted web content may lead to arbitrary code execution","start":165,"end":244}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Browser processes crafted content, executing code","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Processing maliciously crafted web content may lead to arbitrary code execution","start":165,"end":244}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-35959","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35959","exploited":true,"exploitedSince":"2022-08-18","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2022-08-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2022-08-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35959","provenance":"source"},{"date":"2022-08-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32893","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":63.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1534 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.12,"detail":"percentile 0.9558"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}