CVE-2022-48610

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2. An app may be able to access user-sensitive data.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 13.1
Apple	watchOS	>= unspecified, < 9.2
Apple	iOS and iPadOS	>= unspecified, < 16.2

References

https://support.apple.com/en-us/102741Release Notes, Vendor Advisory
https://support.apple.com/en-us/102807Release Notes, Vendor Advisory
https://support.apple.com/en-us/102808Release Notes, Vendor Advisory

Timeline

Published: Mar 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-486117.8A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate CVE-2022-486126.1A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScr CVE-2022-486135.9Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with t CVE-2022-486146.1Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.CVE-2022-486157.1An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial devi CVE-2022-486167.5A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers CVE-2022-486187.0The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. A CVE-2022-486195.5An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) becau CVE-2022-48627.6Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content CVE-2022-486209.8uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.CVE-2022-486217.5Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect CVE-2022-486227.8In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_loa