CVE-2022-32898
Published: 01 November 2022
Summary
CVE-2022-32898 is a high-severity an unspecified weakness vulnerability in Apple Ipados. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 14.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-32898 is a memory-handling vulnerability that affects multiple Apple platforms. The flaw was addressed through improved memory handling and impacts iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, and watchOS 9. An application running on an affected device may be able to execute arbitrary code with kernel privileges. The vulnerability carries a CVSS 3.1 base score of 7.8 reflecting local attack vector, low complexity, no required privileges, and required user interaction.
An attacker can exploit the issue by supplying a malicious application that a user is tricked into executing. Successful exploitation grants the app kernel-level code execution, enabling full compromise of the device confidentiality, integrity, and availability.
Apple security advisories for the affected platforms state that the issue is resolved by installing the listed updates, which incorporate the improved memory handling fixes.
The EPSS score rose from a low baseline to a peak of 0.0534 on 2025-12-11 before receding to the current value of 0.0249.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35964
Vulnerability details
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.