CVE-2022-22674

Apple macOS Out-of-Bounds Read

5.5 MEDIUMActively exploited (CISA KEV)EPSS 1.13%

Published26 May 2022
Added to CISA KEV4 Apr 2022
Remediation due25 Apr 2022

Description

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Apple macOS≥ 11.0 < 11.6.6 · ≥ 12.0.0 < 12.3.1

Apple Mac OS X≥ 10.15 < 10.15.7 · 10.15.7

Remediation

Fixed in

Apple macOS≥ 11.6.6

Apple Mac OS X≥ 10.15.7

Patch & vendor advisories

References

https://support.apple.com/en-us/HT213220Release NotesVendor Advisory
https://support.apple.com/en-us/HT213255Release NotesVendor Advisory
https://support.apple.com/en-us/HT213256Release NotesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22674Third Party AdvisoryUS Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-22674 being actively exploited?

Yes. CVE-2022-22674 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 4 Apr 2022.

How severe is CVE-2022-22674?

CVE-2022-22674 has a CVSS 3.1 base score of 5.5, rated medium. EPSS estimates a 1.13% probability of exploitation.

Which products are affected by CVE-2022-22674?

Affected products include Apple macOS, Apple Mac OS X.

How do I fix CVE-2022-22674?

Upgrade affected software to a fixed version, for example Apple macOS 11.6.6, Apple Mac OS X 10.15.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-22674 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.