CVE-2022-22675highunder attackCWE-787

CVE-2022-22675: high-severity vulnerability in Apple watchOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 12%
from disclosure to weapon
Published on NVDMay 26
CISA KEVApr 4
Action required by CISAfederal deadline: 2022-04-25

Apply updates per vendor instructions.

In short

A flaw in Apple software allows an app to write data beyond intended memory boundaries, potentially letting it run malicious code with system-level privileges. This is a serious vulnerability that attackers are already exploiting.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in Apple kernel code due to insufficient bounds checking. Local execution vector requiring app installation; successful exploitation grants kernel-level code execution. Fixed across iOS, iPadOS, macOS, tvOS, and watchOS platforms; active exploitation reported in the wild.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · macOSApple · watchOS
Related CVEs — Apple watchOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 63.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV