CVE-2022-42827
Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
Description
CVE-2022-42827 is an out-of-bounds write vulnerability affecting Apple iOS and iPadOS, fixed in iOS 15.7.1, iPadOS 15.7.1, iOS 16.1, and iPadOS 16. This out-of-bounds write weakness (CWE-787) can be exploited by a malicious application to execute arbitrary code with kernel privileges, effectively allowing a complete device takeover. Apple acknowledged reports of active exploitation in the wild at the time of disclosure. CISA has confirmed this by adding CVE-2022-42827 to the Known Exploited Vulnerabilities catalog, reflecting the serious real-world threat this vulnerability poses to Apple mobile devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.7.1 |
| apple | iphone os | < 15.7.1; >= 16.0, < 16.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213489(Vendor Advisory)
- https://support.apple.com/en-us/HT213490(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42827(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CWE-787 describes a weakness where software writes data past the end or before the beginning of an intended buffer, corrupting adjacent memory. In CVE-2022-42827, insufficient bounds checking in an iOS or iPadOS kernel component allows an application to write memory beyond its allocated buffer boundary, corrupting kernel data structures and enabling privilege escalation to kernel execution context.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2022-42827 carries a CVSS 3.1 score of 7.8 (High), reflecting its local exploitability with severe impact. Attack Vector (Local): exploitation requires a malicious application to be installed and executed on the target iOS or iPadOS device, meaning the attacker must either have physical access to the device or trick the victim into installing a malicious app. Attack Complexity (Low): once a malicious application is on the device, triggering the vulnerability requires no special conditions or timing. Privileges Required (None): the exploiting application does not need to hold any elevated permissions before triggering the vulnerability. User Interaction (Required): the victim must take some action, such as opening a malicious application. Confidentiality, Integrity, and Availability (all High): successful exploitation grants an application arbitrary code execution at the kernel privilege level, enabling complete access to all data on the device, modification of any system component, and the ability to disable or crash the device. Kernel-level code execution effectively represents a complete device compromise, bypassing all iOS security sandboxing mechanisms.
Exploit Maturity
Apple explicitly stated awareness of active exploitation in the wild at the time CVE-2022-42827 was disclosed in October 2022, and CISA confirmed this by adding the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 15, 2022. No external exploit code references are tagged in the available references, consistent with Apple's typical approach of not publicly disclosing exploitation details. The EPSS score of 0.2% (42nd percentile) reflects limited automated scanning activity, but the Apple and CISA confirmed in-the-wild exploitation indicates targeted or spyware-related use. Out-of-bounds write vulnerabilities in iOS kernel components are frequently associated with sophisticated mobile exploit chains used by commercial surveillance vendors targeting high-value individuals.
Remediation
- Update to iOS 15.7.1 / iPadOS 15.7.1 or iOS 16.1 / iPadOS 16 — Apple released fixes for CVE-2022-42827 in these versions in October 2022. Update all affected Apple devices immediately via Settings > General > Software Update.
- If the update cannot be applied, discontinue use — Per CISA's KEV required action: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Restrict application installation to the App Store — Enable the "Allow App Store apps only" restriction (via Screen Time or MDM) to reduce the risk of malicious application installation that could exploit CVE-2022-42827.
- Apply MDM-enforced update compliance — Use Mobile Device Management solutions to verify all managed iOS and iPadOS devices are running patched versions and enforce minimum OS version requirements.
- Monitor for jailbreak indicators — Out-of-bounds write exploits leading to kernel code execution are characteristic of jailbreak techniques. Use mobile threat detection tools to identify devices exhibiting jailbreak-like behaviors, which may indicate successful exploitation.
Technical Details
CVE-2022-42827 exploits an out-of-bounds write weakness (CWE-787) in an iOS or iPadOS kernel component resulting from inadequate bounds checking. When a userspace application provides input that causes a kernel operation to write beyond the boundaries of an allocated buffer, adjacent kernel memory structures can be corrupted. Apple addressed this with improved bounds checking in the affected component. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows the attack is local (requires a running malicious app), low complexity, and requires no prior privileges, while delivering full confidentiality, integrity, and availability compromise at the kernel level. Out-of-bounds write primitives in kernels are powerful because they allow controlled corruption of kernel data structures — such as credentials objects or function pointers — that can be used to escalate from application-level code execution to kernel privilege execution, bypassing iOS's application sandbox entirely.
Frequently Asked Questions
Is CVE-2022-42827 being actively exploited?
Yes. Apple confirmed awareness of reports of active exploitation at the time of disclosure, and CISA added CVE-2022-42827 to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 15, 2022. Exploitation has been observed in the wild, potentially associated with sophisticated mobile spyware campaigns.
What products are affected by CVE-2022-42827?
CVE-2022-42827 affects Apple iOS and iPadOS versions prior to 15.7.1 and prior to 16.1/iPadOS 16. Devices running iOS 15.x should update to 15.7.1 or later, and devices running iOS 16.x should update to 16.1 or later. All iPhone and iPad models capable of running these versions are affected.
How do I fix CVE-2022-42827?
Update your iPhone or iPad to iOS/iPadOS 15.7.1 or iOS/iPadOS 16.1 (or any later release). Go to Settings > General > Software Update to check and install the update. Enterprise administrators should use MDM solutions to push and verify the update across all managed devices.
How severe is CVE-2022-42827?
CVE-2022-42827 has a CVSS 3.1 score of 7.8 (High severity). While exploitation requires local access via a malicious application, successful exploitation grants kernel-level code execution — representing a complete device compromise. The EPSS score of 0.2% places it at the 42nd percentile, but Apple and CISA's confirmation of active exploitation makes this significantly more urgent than the score alone would suggest.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.