Apple Memory Corruption Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2022-22587 · Published 18/03/2022 · updated 17/06/2026

Apple Memory Corruption Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 28/01/2022. Patch affected systems as an emergency.

In short

CVE-2022-22587 is a CRITICAL (CVSS 9.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 28/01/2022.
Chance of exploitation in the next 30 days (EPSS): 11.6%, higher than 96.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
iOS and macOS Apple	Versions not published yet (product named by CISA KEV)

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

References

support.apple.com/en-us/HT213053 · Release Notes
support.apple.com/en-us/HT213054 · Release Notes
support.apple.com/en-us/HT213055 · Release Notes
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2022-22587

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free