CVE-2022-22674

Apple's macOS kernel contained an out-of-bounds read (CWE-125) caused by insufficient input validation, which allowed a local user to read kernel memory. It is triggered by a local application or user on the machine interacting with the vulnerable kernel code path; there is no remote or unauthenticated attack vector. Successful exploitation discloses kernel memory (high confidentiality impact per the CVSS 5.5 local-attack score), but it does not by itself provide code execution or privilege escalation. All users of macOS Monterey, Big Sur, and Catalina who have not applied the March 2022 fixes are affected. The flaw is confirmed exploited in the wild: Apple shipped emergency patches alongside a WebKit zero-day in late March 2022, CISA added it to the KEV on 2022-04-04, and EPSS puts the 30-day exploitation probability at 1.1%; no public PoC is known, but the KEV listing reflects real-world exploitation.

What to do: Upgrade to macOS Monterey 12.3.1, macOS Big Sur 11.6.6, or apply Security Update 2022-004 for Catalina; because this flaw is in CISA's Known Exploited Vulnerabilities catalog, treat patching as urgent. Inventory Macs for their installed macOS version (Apple menu > About This Mac) and confirm no unpatched machines remain. Until patched, limit local code execution from untrusted users or applications, since exploitation requires local access.