Live › vulnerability › CVE-2022-48618
Go to dashboardApple iOS, iPadOS, macOS, tvOS and watchOS contain a time-of-check/time-of-use memory corruption flaw that lets an attacker with read and write access bypass Pointer Authentication. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apple Multiple Products | vendor | – | – |
| apple ipados | vendor | < 16.2 | 16.2 |
| apple iphone os | vendor | < 16.2 | 16.2 |
| apple macos | vendor | >= 13.0, < 13.1 | 13.1 |
| apple tvos | vendor | < 16.2 | 16.2 |
| apple watchos | vendor | < 9.2 | 9.2 |
Check the device OS version under Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare it to Apple's security notes; the sources do not give fixed versions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2022-48618")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.