CVE-2022-42856
KEVApple iOS Type Confusion Vulnerability
Description
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedDec 15, 2022
Last modifiedJun 17, 2026
Added to KEVDec 14, 2022
Remediation dueJan 4, 2023
References
- seclists.org/fulldisclosure/2022/Dec/21Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/22Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/23Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/26Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/28Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2022/12/26/1Mailing ListThird Party Advisory
- security.gentoo.org/glsa/202305-32Third Party Advisory
- support.apple.com/en-us/HT213516Release NotesVendor Advisory
- support.apple.com/en-us/HT213531Release NotesVendor Advisory
- support.apple.com/en-us/HT213532Release NotesVendor Advisory
- support.apple.com/en-us/HT213535Release NotesVendor Advisory
- support.apple.com/en-us/HT213537Release NotesVendor Advisory
0 recent articles mention this CVE
75
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1392 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 8.5% · top 5% of all CVEs
- Weakness
- CWE-843
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.