high7.0Known exploited
CVE-2022-48618
Apple Multiple Products Memory Corruption Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-01-31. Federal due date: 2024-02-21.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Ipados | before 16.2 |
| Apple | Iphone Os | before 16.2 |
| Apple | Macos | from 13.0 before 13.1 |
| Apple | Tvos | before 16.2 |
| Apple | Watchos | before 9.2 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.apple.com/en-us/HT213530
- https://support.apple.com/en-us/HT213532
- https://support.apple.com/en-us/HT213535
- https://support.apple.com/en-us/HT213536
- https://support.apple.com/en-us/HT213530
- https://support.apple.com/en-us/HT213532
- https://support.apple.com/en-us/HT213535
- https://support.apple.com/en-us/HT213536
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-48618