---
id: "CVE-2022-42856"
kind: "vulnerability"
aliases: ["CVE-2022-42856"]
title: "A type confusion issue was addressed with improved state handling"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Apple iOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple safari", "fixed": ["16.2"], "affected": "< 16.2", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["15.7.2"], "affected": "< 15.7.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["15.7.2"], "affected": "< 15.7.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["16.1.2"], "affected": ">= 16.0, < 16.1.2", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["13.1"], "affected": "< 13.1", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["16.2"], "affected": "< 16.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ios", "ipad", "iphone", "mobile-fleet"]
not_affected_if: ["patched-ios-version"]
published_at: "2022-12-14T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42856", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42856", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A type confusion issue was addressed with improved state handling

Apple iOS has a type confusion bug in its web content processing that lets a malicious web page run code. Attackers have used it in real attacks, according to CISA's exploited-vulnerabilities catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS affected ? fixed ?
- vendor:apple safari affected < 16.2 fixed 16.2
- vendor:apple ipados affected < 15.7.2 fixed 15.7.2
- vendor:apple iphone os affected < 15.7.2 fixed 15.7.2
- vendor:apple iphone os affected >= 16.0, < 16.1.2 fixed 16.1.2
- vendor:apple macos affected < 13.1 fixed 13.1
- vendor:apple tvos affected < 16.2 fixed 16.2

## How to check

Settings > General > About on the device to see the iOS version; unknown for fleet-wide checks.

## Fix

Update iOS to a version Apple lists as fixing CVE-2022-42856 (unknown exact version from sources); apply vendor updates per CISA instructions.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42856
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-42856

## From the sources

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_