{"id":"CVE-2022-46690","published":"2022-12-15T00:00:00Z","modified":"2025-04-21T14:06:38Z","title":"An out-of-bounds write issue was addressed with improved input validation","vendor":"Apple","product":"tvOS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apple","product":"tvOS","versions":[">= unspecified, < 16.2"]},{"vendor":"Apple","product":"tvOS","versions":[">= unspecified, < 13.1"]},{"vendor":"Apple","product":"tvOS","versions":[">= unspecified, < 16.2"]},{"vendor":"Apple","product":"watchOS","versions":[">= unspecified, < 9.2"]}],"description":{"text":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00556,"percentile":0.46285,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-07-01","exploitedFirstSeen":"2023-07-01","ransomware":false,"evidence":[{"url":"https://securelist.com/operation-triangulation/109842/","date":"2023-07-01"},{"url":"https://go.recordedfuture.com/hubfs/reports/CTA-2024-0416.pdf","date":"2024-04-16"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Operation Triangulation: iOS devices targeted with previously unknown malware | Securelist","url":"https://otx.alienvault.com/pulse/647eee55c96ad482af640e2e","created":"2023-06-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://support.apple.com/en-us/HT213535","tags":[]},{"url":"https://support.apple.com/en-us/HT213532","tags":[]},{"url":"https://support.apple.com/en-us/HT213530","tags":[]},{"url":"https://support.apple.com/en-us/HT213536","tags":[]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/20","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/23","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/26","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/27","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-49479","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-49479","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-12-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-46690","provenance":"source"},{"date":"2023-07-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/operation-triangulation/109842/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":50.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1216 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.26,"detail":"percentile 0.4628"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}