{"id":"CVE-2022-48618","published":"2024-01-09T18:15:45Z","modified":"2026-06-17T05:15:43Z","title":"Apple Multiple Products Memory Corruption Vulnerability","vendor":"Apple","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability is a memory corruption flaw in Apple's multiple products, affecting macOS, watchOS, iOS, iPadOS and tvOS, and is described as a time-of-check to time-of-use race condition. An attacker who already has arbitrary read and write capability and local access (the vector is local, with high attack complexity and low privileges required, and no user interaction) may be able to bypass Pointer Authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:07Z"},"cvss":{"score":7.0,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00487,"percentile":0.41856,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-01-31","dueDate":"2024-02-21","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.apple.com/en-us/HT213530, https://support.apple.com/en-us/HT213532, https://support.apple.com/en-us/HT213535, https://support.apple.com/en-us/HT213536;  https://nvd.nist.gov/vuln/detail/CVE-2022-48618","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-09","exploitedFirstSeen":"2024-01-09","ransomware":false,"evidence":[{"url":"https://support.apple.com/en-us/102808","date":"2024-01-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-31"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://support.apple.com/en-us/HT213530","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213532","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213535","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213536","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213530","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213532","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213535","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213536","tags":["Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-48618","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploits memory corruption primitive for privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication","start":139,"end":236}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypasses Pointer Authentication security mechanism","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may be able to bypass Pointer Authentication","start":192,"end":236}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-51313","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51313","exploited":true,"exploitedSince":"2024-01-31","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1211"],"provenance":"ai"}],"timeline":[{"date":"2024-01-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48618","provenance":"source"},{"date":"2024-01-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.apple.com/en-us/102808","provenance":"source"},{"date":"2024-01-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51313","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":22},"priority":{"score":51.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1024 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.37,"detail":"percentile 0.4186"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-367"}}