CVE-2022-42856
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Apple iOS Type Confusion Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 9% (percentile: 95) as of 2 November 2026
- CWE
- CWE-843
Affected products
apple: safari; apple: ipados; apple: iphone os; apple: macos; apple: tvos
References
- https://support.apple.com/en-us/HT213516 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213531 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213532 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213535 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213537 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213516 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213531 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213532 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213535 Release NotesVendor Advisory
- https://support.apple.com/en-us/HT213537 Release NotesVendor Advisory