CVE-2022-22620

high-risk
Published 2022-03-18

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Do I need to act?

~
4.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Apple

References (9)

Third Party Advisory https://security.gentoo.org/glsa/202208-39
Release Notes https://support.apple.com/en-us/HT213091
Release Notes https://support.apple.com/en-us/HT213092
Release Notes https://support.apple.com/en-us/HT213093
Third Party Advisory https://security.gentoo.org/glsa/202208-39
Release Notes https://support.apple.com/en-us/HT213091
Release Notes https://support.apple.com/en-us/HT213092
Release Notes https://support.apple.com/en-us/HT213093
Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...
54
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 14/34 · Moderate
Exposure 10/34 · Low