CVE-2022-48503

CVE-2022-48503 is a bounds-checking flaw (CWE-129, improper validation of array index) in the web content processing engine used by Safari and by web views across Apple platforms, rated 8.8 (High) with a network attack vector and user interaction required. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting a hostile webpage, and gains arbitrary code execution in the context of the application rendering that content. Anyone running Safari or iOS, iPadOS, macOS Monterey, tvOS, or watchOS versions prior to the fixed releases (iOS/iPadOS 15.6, macOS Monterey 12.5, Safari 15.6, tvOS 15.6, watchOS 8.7) is affected, with older devices that cannot upgrade at greatest risk. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2025-10-20, confirming exploitation in the wild, and October 2025 reporting on the Coruna iOS exploit kit describes exploit chains being used against older iOS versions. EPSS currently assigns a 3.2% probability of exploitation in the next 30 days (87th percentile); ransomware use is unknown.

What to do: Update affected devices to iOS/iPadOS 15.6 or later, macOS Monterey 12.5 or later, Safari 15.6 or later, tvOS 15.6 or later, and watchOS 8.7 or later; for older devices that cannot run these versions, apply Apple's emergency fixes for older iOS releases as reported in recent advisories. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of affected products if mitigations are unavailable. Inventory managed Apple fleets for OS/Safari versions below the fixed releases and treat unpatched devices' web browsing as an unauthenticated code-execution risk until patched.