CVEvulnerability
CVE-2022-42856
CISA Known Exploited Vulnerability
Apple iOS Type Confusion Vulnerability — Apple iOS
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
- Added to KEV
- 2022-12-14
- Remediation due
- 2023-01-04
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://support.apple.com/en-us/HT213516; https://nvd.nist.gov/vuln/detail/CVE-2022-42856
- Status
- Analyzed
- Published
- 2022-12-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-843
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
Affected configurations
• apple safari (< 16.2)
• apple ipados (< 15.7.2)
• apple iphone os (< 15.7.2)
• apple iphone os (>= 16.0 < 16.1.2)
• apple macos (< 13.1)
• apple tvos (< 16.2)
Related
Weakness · CWE (1)
- CWE-843 Access of Resource Using Incompatible Type weakness
References
- http://seclists.org/fulldisclosure/2022/Dec/21 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/22 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/23 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/26 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/28 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/12/26/1 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202305-32 Third Party Advisory
- https://support.apple.com/en-us/HT213516 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213531 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213532 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213535 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213537 Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2022/Dec/21 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/22 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/23 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/26 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Dec/28 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/12/26/1 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202305-32 Third Party Advisory
- https://support.apple.com/en-us/HT213516 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213531 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213532 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213535 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213537 Release Notes, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856 US Government Resource