{"id":"CVE-2022-42856","kind":"vulnerability","aliases":["CVE-2022-42856"],"related":[],"title":"A type confusion issue was addressed with improved state handling","description":"A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..","summary":"Apple iOS has a type confusion bug in its web content processing that lets a malicious web page run code. Attackers have used it in real attacks, according to CISA's exploited-vulnerabilities catalog.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2022-12-14T00:00:00+00:00","products":[{"name":"Apple iOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["16.2"],"affected":"< 16.2","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.7.2"],"affected":"< 15.7.2","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.7.2"],"affected":"< 15.7.2","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.1.2"],"affected":">= 16.0, < 16.1.2","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.1"],"affected":"< 13.1","ecosystem":"vendor"},{"name":"apple tvos","fixed":["16.2"],"affected":"< 16.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ios","ipad","iphone","mobile-fleet"],"not_affected_if":["patched-ios-version"],"how_to_check":"Settings > General > About on the device to see the iOS version; unknown for fleet-wide checks.","fix":"Update iOS to a version Apple lists as fixing CVE-2022-42856 (unknown exact version from sources); apply vendor updates per CISA instructions.","status":"open","published_at":"2022-12-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:08:50Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS to a version Apple lists as fixing CVE-2022-42856 (unknown exact version from sources); apply vendor updates per CISA instructions.","reach":"internet","impact":"high","summary":"Apple iOS has a type confusion bug in its web content processing that lets a malicious web page run code. Attackers have used it in real attacks, according to CISA's exploited-vulnerabilities catalog.","category":"infrastructure","who_cares":["ios","iphone","ipad","mobile-fleet"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the device via a crafted web page.","analyst_note":"Confirm the fixed iOS version and affected release range from Apple's security notes for CVE-2022-42856 (not in the sources).","how_to_check":"Settings > General > About on the device to see the iOS version; unknown for fleet-wide checks.","needs_analyst":true,"not_affected_if":["patched-ios-version"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000465,"input_tokens":2767,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':12A,15A '-42856':13A,16A '..':138C '13.1':97C '15.1':137C '15.7.2':99C,102C '16.1.2':104C '16.2':92C,94C 'accord':68B 'activ':128C 'address':6A,81C 'appl':41B,116C 'apple':17A,19A,21A,23A,26A,29A,31A 'arbitrari':113C 'attack':61B,67B 'awar':118C 'bug':47B 'catalog':75B 'cisa':70B 'code':60B,114C 'confus':3A,46B,78C 'content':51B,109C 'craft':107C 'cve':11A,14A 'execut':115C 'exploit':33B,73B,129C 'exploited-vulner':72B 'fix':89C 'fleet':40B 'handl':10A,85C 'improv':8A,83C 'infrastructur':34B 'io':35B,42B,98C,103C,133C,136C 'ios':18A 'ipad':36B 'ipado':101C 'ipados':22A 'iphon':37B 'iphone':24A,27A 'issu':4A,79C,87C,124C 'lead':111C 'let':54B 'maco':95C 'macos':30A 'malici':56B,106C 'may':110C,125C 'mobil':39B 'mobile-fleet':38B 'os':25A,28A 'page':58B 'process':52B,105C 'real':66B 'releas':134C 'report':121C 'run':59B 'safari':20A,91C 'state':9A,84C 'tvos':32A,93C 'type':2A,45B,77C 'use':63B 'ventura':96C 'version':131C 'vulner':74B 'web':50B,57B,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-12-14T00:00:00+00:00","kev":{"dateAdded":"2022-12-14","dueDate":"2023-01-04","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-42856","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42856","severity":null,"published_at":"2022-12-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-42856","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42856","severity":null,"published_at":"2022-12-15T19:15:25+00:00","modified_at":"2026-06-17T05:05:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}