CVE-2022-48503
Published: 14 August 2023
Summary
CVE-2022-48503 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Apple Safari. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 36.0th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
The vulnerability is an insufficient bounds checking issue that affects multiple Apple platforms when processing web content. Impacted software includes iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, tvOS 15.6, watchOS 8.7, and Safari 15.6. The flaw carries a CVSS 3.1 base score of 8.8 and is tracked under CWE-129.
An unauthenticated remote attacker can exploit the issue by supplying malicious web content that the victim processes in a vulnerable browser or application. Successful exploitation results in arbitrary code execution with the privileges of the affected process, requiring only that the user interact with the content such as by visiting a crafted web page.
Apple security advisories for HT213340, HT213341, HT213342, HT213345, and HT213346 state that the issue was resolved through improved bounds checks and recommend installing the listed updates to eliminate the vulnerability. The current EPSS score of 0.0016 indicates low observed exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51199
Vulnerability details
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
- CWE(s)
- KEV Date Added
- 20 October 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces input validation and bounds checking on untrusted web content to block the out-of-bounds access that enables arbitrary code execution.
Applies memory protection mechanisms that can block exploitation of the out-of-bounds memory access leading to code execution.
Provides malicious code detection and blocking for web content that attempts to trigger the bounds-checking flaw.