CVE-2022-22675

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 4, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-226765.5An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2.CVE-2022-226774.3A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iO CVE-2022-226794.9Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskS CVE-2022-22687.2The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without valida CVE-2022-226807.5Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42 CVE-2022-226817.5Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass s CVE-2022-226825.4Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar CVE-2022-226839.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-CVE-2022-226848.8Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Syn CVE-2022-226858.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server b CVE-2022-226868.0Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users CVE-2022-226879.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation