Apple fixes actively exploited zero-day in macOS, iOS (CVE-2022-32917)

Apple's August 2022 emergency update fixed an out-of-bounds write (CWE-787) in the kernel of iOS, iPadOS and macOS Monterey, corrected in iOS/iPadOS 15.6.1 and macOS Monterey 12.5.1. The attack vector is local (CVSS AV:L with user interaction required), meaning a victim must run a malicious application or file that triggers the flawed bounds checking and overwrites kernel memory. Successful exploitation allows arbitrary code execution with kernel privileges, effectively giving the attacker full control of the device. Users of iPhones, iPads and Macs running versions before the patched releases are affected; watchOS also appears in the product data, though no fixed version for it is specified. Apple acknowledged reports of active exploitation and CISA added the flaw to its KEV catalog on 2022-08-18, so in-the-wild exploitation is confirmed even though no public PoC is known.

Do: Update iPhones and iPads to iOS/iPadOS 15.6.1 and Macs to macOS Monterey 12.5.1, per Apple's advisories and the KEV required action to apply vendor updates. For older devices that cannot run iOS 15, check Apple's security advisories for a vendor-supplied update applicable to that hardware generation. Inventory fleet OS versions (e.g., via MDM) and treat unpatched devices as at risk of kernel-level compromise.

CVE-2022-32917 is an out-of-bounds write (CWE-787) in the Apple operating system kernel that the vendor fixed with improved bounds checks. A local application running on a vulnerable device can trigger the flaw to execute arbitrary code with kernel privileges, giving an attacker full control of the device; the local (AV:L) attack vector means the attacker must already be able to run code on the device, such as through a malicious app, rather than reaching the flaw over the network. Users of Apple devices running iOS, iPadOS, or macOS versions earlier than the fixed releases are affected. Apple reported that the issue may have been actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-09-14 with no public proof-of-concept known.

Do: Update affected devices without delay to iOS 16 or iOS 15.7, iPadOS 15.7, macOS Monterey 12.6, or macOS Big Sur 11.7 (or any later release). Inventory Apple endpoints for outdated OS versions and prioritize patching because the flaw is on CISA's KEV catalog and was reported actively exploited. Since exploitation requires already running code on the device, review installed apps and treat the flaw as exploitable when chained with other local or app-delivery attack vectors.