CVE-2022-26716: Buffer Overflow

Q: What is CVE-2022-26716?

CVE-2022-26716 is a memory corruption issue in WebKit that was addressed with improved state management.

Q: Which software versions are affected by CVE-2022-26716?

CVE-2022-26716 affects Apple Safari versions up to but not including 15.5, Apple watchOS versions up to but not including 8.6, Apple tvOS versions up to but not including 15.5, macOS Monterey versions up to but not including 12.4, Apple iOS versions up to but not including 15.5, and Apple iPadOS versions up to but not including 15.5.

Q: How can I fix CVE-2022-26716?

To fix CVE-2022-26716, update your software to the latest version available. For more information, refer to the official Apple security updates.

Published May 16, 2022

Updated

A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Credit

Arsenii Kostromin (0x3c3e)(Microsoft), Jonathan Bar Or(Microsoft), Wojciech Reguła@@_r3ggi(SecuRing), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), Yuebin Sun@@yuebinsun2020(Tencent Security Xuanwu Lab), Max Shavrick@@_mxms(the Google Security Team), Zubair Ashraf(Crowdstrike), CVE-2022-0778, CVE-2022-23308, Paul Walker(Bury), Nathaniel Ekoniak(Ennate Technologies), Mickey Jin@@patch1t, @@gorelics, an anonymous researcher, Linus Henze(Pinauten GmbH), Peter Nguyễn Vũ Hoàng(STAR Labs), Felix Poulin-Belanger, Gergely Kalman@@gergely_kalman(Mandiant), (Mandiant), Joshua Mason(Mandiant), Antonio Cheong Yu Xuan(YCISCQ), Arsenii Kostromin (0x3c3e), Ron Waisberg(SecuRing), an anonymous researcher(SecuRing), (Perception Point), Ron Hass@@ronhass7(Perception Point), ryuzaki, Chijin Zhou(ShuiMuYuLin Ltd), Tsinghua wingtecher lab, Jeonghoon Shin(Theori), SorryMybad@@S0rryMybad(Kunlun Lab), Dongzhuo Zhao(ADLab of Venustech), Scarlet Raine, Wang Yu(Cyberserval), CVE-2022-0530, Tavis Ormandy, CVE-2021-45444, ABC Research s.r.o, CVE-2021-44224, CVE-2021-44790, CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Qi Sun(Trend Micro), Robert Ai(Trend Micro), Ye Zhang@@co0py_Cat(Baidu Security), Jon Thompson(Evolve), IA), Yonghwi Jin@@jinmo123(Theori), actae0n(Blacksun Hackers Club working with Trend Micro Zero Day Initiative), Andrew Williams(Google), Avi Drissman(Google), Liu Long(Ant Security Light), Antonio Zekic@@antoniozekic, Jeonghoon Shin(Theori working with Trend Micro Zero Day Initiative), Jack Dates(RET2 Systems Inc), chenyuwang@@mzzzz__(Tencent Security Xuanwu Lab), Jordy Zomer@@pwningsystems, Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs), Ned Williamson(Google Project Zero)

Affected Software

15 affected componentsFixes available

debian/webkit2gtk

2.36.4-1~deb10u12.38.6-0+deb10u12.40.5-1~deb11u12.42.1-1~deb11u22.40.5-1~deb12u12.42.1-1~deb12u12.42.1-2

debian/wpewebkit

2.38.6-1~deb11u12.38.6-12.42.1-1

Apple tvOS<15.5

15.5

Apple WatchOS<8.6

8.6

Apple macOS Monterey<12.4

12.4

Apple Safari<15.5

15.5

Apple iOS<15.5

15.5

Apple iPadOS<15.5

15.5

Apple Safari<15.5

Apple iPadOS<15.5

Apple iPhone OS<15.5

Apple macOS>=12.0.0<12.4

Apple tvOS<15.5

Apple WatchOS<8.6

redhat/webkitgtk<2.36.3

2.36.3

Event History

Jun 2, 2022

Data Sourced

via Red Hat·07:16 AM

DescriptionSeverityAffected Software

Nov 1, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2022-26716?

CVE-2022-26716 is a memory corruption issue in WebKit that was addressed with improved state management.

Which software versions are affected by CVE-2022-26716?

CVE-2022-26716 affects Apple Safari versions up to but not including 15.5, Apple watchOS versions up to but not including 8.6, Apple tvOS versions up to but not including 15.5, macOS Monterey versions up to but not including 12.4, Apple iOS versions up to but not including 15.5, and Apple iPadOS versions up to but not including 15.5.

How can I fix CVE-2022-26716?

To fix CVE-2022-26716, update your software to the latest version available. For more information, refer to the official Apple security updates.

CVE-2022-26716: Buffer Overflow

Credit

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2022-26716?

Which software versions are affected by CVE-2022-26716?

How can I fix CVE-2022-26716?

Company

Resources

Contact