CVE-2022-42856

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A type confusion vulnerability addressed through improved state handling affects multiple Apple platforms including Safari, iOS, iPadOS, tvOS, and macOS. The flaw resides in the handling of web content and is fixed in Safari 16.2, iOS 15.7.2, iPadOS 15.7.2, iOS 16.1.2, tvOS 16.2, and macOS Ventura 13.1. Successful exploitation of maliciously crafted web content can result in arbitrary code execution, as reflected in the CVSS 8.8 rating for network-accessible attacks requiring user interaction.

An attacker can deliver malicious web content to a victim through a browser or web-enabled application on the affected platforms. If the target processes the content, the type confusion issue may be triggered to achieve code execution within the context of the vulnerable process, potentially allowing full compromise of the device or browser session.

Apple security updates released in December 2022 remediate the issue by updating the listed platform versions, with full advisories published via the referenced seclists.org disclosures. Users are advised to apply the patches promptly to eliminate the exposure.

Apple has stated that the vulnerability may have been actively exploited in the wild against iOS versions prior to 15.1. The associated EPSS score rose materially from a low baseline to a peak of 0.0281 shortly after disclosure on 2023-01-01 before receding, indicating a temporary increase in observed exploitation interest.