CVE-2022-22620

Apple Safari (v and ), Apple macOS

Published 18 Mar 2022 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 11 Feb 2022, with a remediation deadline of 25 Feb 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

References

security.gentoo.org/glsa/202208-39 · Third Party Advisory
support.apple.com/en-us/HT213091 · Release Notes, Vendor Advisory
support.apple.com/en-us/HT213092 · Release Notes, Vendor Advisory
support.apple.com/en-us/HT213093 · Release Notes, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22620 · Third Party Advisory, US Government Resource