CVE-2022-26726
Published: 26 May 2022
Summary
CVE-2022-26726 is a medium-severity an unspecified weakness vulnerability in Apple Mac Os X. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-26726 is a logic issue resulting from insufficient validation checks that affects multiple Apple operating systems, including macOS Catalina via Security Update 2022-004, macOS Big Sur 11.6.6, macOS Monterey 12.4, and watchOS 8.6. The flaw permits an application to capture a user's screen, carrying a CVSS 3.1 base score of 6.5 that reflects network attack vector, low complexity, no required privileges, and required user interaction.
An attacker can exploit the vulnerability by supplying a malicious application that the victim must install or execute. Successful exploitation allows the app to obtain screen contents, producing a high-integrity impact without affecting confidentiality or availability.
Apple security advisories for the listed updates state that the issue was resolved through improved checks and direct administrators to apply the corresponding patches for Catalina, Big Sur, Monterey, and watchOS. The associated EPSS score has remained flat at 0.0852 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31276
Vulnerability details
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina, watchOS 8.6, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to capture a user's screen.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.