Apple macOS up to 13.0 ImageIO out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, was found in Apple macOS. This affects an unknown part of the component ImageIO. Such manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2022-46693. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple macOS (Operating System). It has been rated as critical. Affected by this issue is some unknown functionality of the component ImageIO. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability.

The weakness was released 12/13/2022 by Mickey Jin as HT213532 as confirmed advisory (Website). The advisory is shared for download at support.apple.com. This vulnerability is handled as CVE-2022-46693. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/22/2025). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:

Processing a maliciously crafted file may lead to arbitrary code execution

Upgrading to version 13.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

An out-of-bounds write issue was addressed with improved input validation.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 5.3
• 5.11
• 10.8.5
• 10.9.5
• 10.10
• 10.10.1
• 10.10.2
• 10.10.3
• 10.12
• 10.12.0
• 10.12.1
• 10.12.2
• 10.12.3
• 10.12.4
• 10.12.5
• 10.12.6
• 10.13
• 10.13.0
• 10.13.1
• 10.13.2
• 10.13.3
• 10.13.4
• 10.13.5
• 10.13.5 2018-003
• 10.13.6
• 10.14
• 10.14.1
• 10.14.2
• 10.14.4
• 10.14.5
• 10.14.6
• 10.15
• 10.15.0
• 10.15.1
• 10.15.2
• 10.15.3
• 10.15.4
• 10.15.5
• 10.15.6
• 10.15.7
• 11.0.1
• 11.1
• 11.2
• 11.2.1
• 11.2.3
• 11.3
• 11.3.1
• 11.4
• 11.5
• 11.6
• 11.6.6
• 11.7
• 11.7.3
• 11.7.5
• 11.7.9
• 12.0.1
• 12.1
• 12.2
• 12.2.1
• 12.3
• 12.3.1
• 12.4
• 12.5
• 12.5.1
• 12.6
• 12.6.2
• 12.6.3
• 12.6.4
• 12.6.7
• 12.6.8
• 12.7
• 12.7.1
• 12.7.5
• 12.7.6
• 13
• 13.0

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion