{"id":"CVE-2022-22587","kind":"vulnerability","aliases":["CVE-2022-22587"],"related":[],"title":"Apple iOS and macOS: Apple Memory Corruption Vulnerability","description":"A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..","summary":"Apple's IOMobileFrameBuffer driver in iOS and macOS has a memory corruption bug. A malicious app can use it to run arbitrary code with kernel privileges.","severity":"critical","cvss":10.0,"epss":0.11638,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"Apple iOS and macOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple-devices","exploited","infrastructure","ios","macos"],"not_affected_if":["fully-patched-devices"],"how_to_check":null,"fix":"Apply the Apple updates per vendor instructions; the fixed versions are not stated in the sources.","status":"open","published_at":"2022-01-28T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:58+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:28:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Apple updates per vendor instructions; the fixed versions are not stated in the sources.","reach":"local","impact":"high","summary":"Apple's IOMobileFrameBuffer driver in iOS and macOS has a memory corruption bug. A malicious app can use it to run arbitrary code with kernel privileges.","category":"infrastructure","who_cares":["ios","macos","apple-devices"],"confidence":0.7,"needs_auth":"no","worst_case":"Malicious app gains kernel privileges and runs arbitrary code on the device.","analyst_note":"Fetch Apple's security advisory for CVE-2022-22587 to confirm affected and fixed OS versions and the exploitation details; the sources here list no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000451,"input_tokens":2830,"output_tokens":336,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':10A,13A '-22587':11A,14A '..':106C '11.6.3':75C '12.2':78C '15.3':68C,71C 'abl':84C 'activ':104C 'address':57C 'and':17A 'app':41B 'appl':1A,5A,20B,26B,92C 'apple':15A 'apple-devic':19B 'applic':81C 'arbitrari':47B,87C 'awar':94C 'big':73C 'bug':38B 'code':48B,88C 'corrupt':7A,37B,54C 'cve':9A,12A 'devic':21B 'driver':29B 'execut':86C 'exploit':22B,105C 'fix':65C 'improv':59C 'infrastructur':23B 'input':60C 'io':2A,24B,31B,67C 'iomobileframebuff':28B 'ios':16A 'ipado':70C 'issu':55C,63C,100C 'kernel':50B,90C 'maco':4A,25B,33B,72C,76C 'macos':18A 'malici':40B,80C 'may':82C,101C 'memori':6A,36B,53C 'monterey':77C 'privileg':51B,91C 'report':97C 'run':46B 'sur':74C 'use':43B 'valid':61C 'vulner':8A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-01-28T00:00:00+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-02-11","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22587","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22587","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-26T01:38:39+00:00","note":null},{"source":"epss","external_id":"CVE-2022-22587","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22587","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22587","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22587","severity":null,"published_at":"2022-03-18T18:15:12+00:00","modified_at":"2026-06-17T04:28:38+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}