Actively exploited · Published Nov 1, 2022 · Assigned by apple
CVE-2022-42827
High 7.8 Exploited
In plain English
A high-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on October 25, 2022). The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 15, 2022.
Official description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | iOS and iPadOS | unspecified – before 16.1 |
| Apple | iOS and iPadOS | unspecified – before 15.7 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H