CVE-2022-22674mediumunder attackCWE-125

CVE-2022-22674: medium-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.5epss 1.1%
from disclosure to weapon
Published on NVDMay 26
CISA KEVApr 4
Action required by CISAfederal deadline: 2022-04-25

Apply updates per vendor instructions.

In short

A flaw allowed local users to read memory data that should be protected by the kernel, potentially exposing sensitive system information. This was fixed by improving how the system validates input data.

Technical detail

An out-of-bounds read vulnerability in kernel memory handling allowed local attackers to disclose kernel memory contents through improper input validation. The vulnerability requires local access and was remediated through enhanced input validation mechanisms across affected macOS versions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Apple · macOS
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV