CVE-2022-32949

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16. An app may be able to execute arbitrary code with kernel privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-32957.5Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-329537.0An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by SMM and non-SMM codeCVE-2022-329547.0An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code CVE-2022-329557.0An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM codCVE-2022-329586.5A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate CVE-2022-329596.8HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffiCVE-2022-32967.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.CVE-2022-329606.8HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffiCVE-2022-329616.8HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffiCVE-2022-329626.8HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnCVE-2022-329637.5OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerabilityCVE-2022-329649.8OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands
CVE-2022-32949: High severity, CVSS 7.8 | Vulnix