CVE-2022-42827: Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
CVE-2022-42827 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2022-10-25
An out-of-bounds write vulnerability in the Apple iOS and iPadOS kernel allows a local application to execute arbitrary code with kernel privileges. The issue was addressed through improved bounds checking in multiple Apple operating systems.
Yes. CVE-2022-42827 is known to be exploited in the wild, first recorded on 25 October 2022. Treat it as urgent.
How severe is CVE-2022-42827?
Critical severity, with a CVSS score of 7.8, published 25 October 2022.
Which products and versions are affected?
Apple iOS < 15.7.1, 16.0; Apple iPadOS < 15.7.1; Apple macOS Monterey < 12.6.1; Apple tvOS < 16.1; and 1 more.
Is there a fix for CVE-2022-42827?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-42827 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2022-42827?
Check whether you run Apple iPadOS, Apple macOS, Apple watchOS or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Apple iOS < 15.7.1, 16.0
Apple iPadOS < 15.7.1
Apple macOS Monterey < 12.6.1
Apple tvOS < 16.1
Apple watchOS < 9.1
Timeline
2022-10-25: disclosed: Initial publication and CISA KEV addition date.
2022-10-25: kev added
2022-11-01: advisory: NVD Published Date.
2022-10-25: exploited: Apple reported awareness of active exploitation.