CVE-2022-42867
Published: 15 December 2022
Summary
CVE-2022-42867 is a high-severity Use After Free (CWE-416) vulnerability in Apple Safari. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A use-after-free vulnerability, tracked as CVE-2022-42867 and assigned CWE-416, affects WebKit-based components in multiple Apple platforms. The flaw was resolved through improved memory management and is corrected in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, and watchOS 9.2. Processing maliciously crafted web content can trigger the issue, which carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges.
An unauthenticated remote attacker can exploit the vulnerability by serving specially crafted web content that a victim processes in an affected browser or application. Successful exploitation yields arbitrary code execution with full confidentiality, integrity, and availability impact on the target system, requiring only that the user interact with the malicious content.
Apple security updates published in December 2022 direct administrators and users to install the listed version upgrades to eliminate the use-after-free condition. The referenced full-disclosure advisories confirm that the patches address the memory-management defect and that no workarounds are provided.
EPSS scores remained modest, rising from a low baseline to a peak of 0.0754 before receding to the current value of 0.0446, indicating limited post-disclosure exploitation interest. No reports of in-the-wild attacks are referenced in the supplied data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45930
Vulnerability details
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code…
more
execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.