CVE-2022-28739: apple macos Out-of-bounds Read

CVSS: 7.5v3.1HighModified

AliasesALPINE-CVE-2022-28739RHSA-2022:5338UBUNTU-CVE-2022-28739+2 more

Published 09-05-2022Last modified 04-11-2025

Vulnerability summary

CVE-2022-28739 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in apple macos. EPSS estimates a 4.37% chance of exploitation in the next 30 days, higher than 91.1% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

4.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 7

DLA-3450-1 DLA-3858-1 MGASA-2022-0143 OPENSUSE-SU-2024:12006-1 OPENSUSE-SU-2024:12712-1 OPENSUSE-SU-2024:13623-1+13 more

Timeline

09-05-2022
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.5v2.04.3

EPSS trend

Probability

4.37%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.37% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Redhat45 products

ruby< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
ruby-debuginfo< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
ruby-debugsource< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
ruby-devel< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
ruby-doc< 0:2.6.10-109.module+el8.6.0+15475+c55337b4

ruby-libs< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
ruby-libs-debuginfo< 0:2.6.10-109.module+el8.6.0+15475+c55337b4
rubygem-abrt< 0:0.3.0-4.module+el8.1.0+3653+beb38eb0
rubygem-abrt-doc< 0:0.3.0-4.module+el8.1.0+3653+beb38eb0
rubygem-bigdecimal< 0:1.4.1-109.module+el8.6.0+15475+c55337b4
rubygem-bigdecimal-debuginfo< 0:1.4.1-109.module+el8.6.0+15475+c55337b4
rubygem-bson< 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
rubygem-bson-debuginfo< 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
rubygem-bson-debugsource< 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
rubygem-bson-doc< 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
rubygem-bundler< 0:1.17.2-109.module+el8.6.0+15475+c55337b4
rubygem-did_you_mean< 0:1.3.0-109.module+el8.6.0+15475+c55337b4
rubygem-io-console< 0:0.4.7-109.module+el8.6.0+15475+c55337b4
rubygem-io-console-debuginfo< 0:0.4.7-109.module+el8.6.0+15475+c55337b4
rubygem-irb< 0:1.0.0-109.module+el8.6.0+15475+c55337b4
rubygem-json< 0:2.1.0-109.module+el8.6.0+15475+c55337b4
rubygem-json-debuginfo< 0:2.1.0-109.module+el8.6.0+15475+c55337b4
rubygem-minitest< 0:5.11.3-109.module+el8.6.0+15475+c55337b4
rubygem-mongo< 0:2.8.0-1.module+el8.1.0+3653+beb38eb0
rubygem-mongo-doc< 0:2.8.0-1.module+el8.1.0+3653+beb38eb0
rubygem-mysql2< 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
rubygem-mysql2-debuginfo< 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
rubygem-mysql2-debugsource< 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
rubygem-mysql2-doc< 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
rubygem-net-telnet< 0:0.2.0-109.module+el8.6.0+15475+c55337b4
rubygem-openssl< 0:2.1.2-109.module+el8.6.0+15475+c55337b4
rubygem-openssl-debuginfo< 0:2.1.2-109.module+el8.6.0+15475+c55337b4
rubygem-pg< 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
rubygem-pg-debuginfo< 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
rubygem-pg-debugsource< 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
rubygem-pg-doc< 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
rubygem-power_assert< 0:1.1.3-109.module+el8.6.0+15475+c55337b4
rubygem-psych< 0:3.1.0-109.module+el8.6.0+15475+c55337b4
rubygem-psych-debuginfo< 0:3.1.0-109.module+el8.6.0+15475+c55337b4
rubygem-rake< 0:12.3.3-109.module+el8.6.0+15475+c55337b4
rubygem-rdoc< 0:6.1.2.1-109.module+el8.6.0+15475+c55337b4
rubygem-test-unit< 0:3.2.9-109.module+el8.6.0+15475+c55337b4
rubygem-xmlrpc< 0:0.3.0-109.module+el8.6.0+15475+c55337b4
rubygems< 0:3.0.3.1-109.module+el8.6.0+15475+c55337b4
rubygems-devel< 0:3.0.3.1-109.module+el8.6.0+15475+c55337b4

Show all 45

Ubuntu4 products

ruby2.3< 2.3.1-2~ubuntu16.04.16+esm3
ruby2.5< 2.5.1-1ubuntu1.12
ruby2.7< 2.7.0-5ubuntu1.7
ruby3.0< 3.0.2-7ubuntu2.1

Debian2 products

ruby2.7< 2.7.4-1+deb11u2
debian_linuxEOL9.0 | 10.0 | 11.0

Alpine1 product

ruby≥ 2.7.0, < 2.7.6-r0 | ≥ 2.7.0, < 3.0.4-r0 | ≥ 2.7.0, < 3.1.2-r0

Apple1 product

macos≥ 11.0, < 11.7.1 | ≥ 12.0, < 12.6.1

Ruby-lang1 product

ruby< 2.6.10 | ≥ 2.7.0, < 2.7.6 | ≥ 3.0.0, < 3.0.4 | ≥ 3.1.0, < 3.1.2

6 vendors · 54 products

References

32 links

hackerone.com/reports/1248108Permissions RequiredThird Party Advisory
security-tracker.debian.org/tracker/CVE-2022-28739AdvisoryThird Party Advisory
www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/REPORTVendor Advisory
security.netapp.com/advisory/ntap-20220624-0002/Third Party Advisory
support.apple.com/kb/HT213488Third Party Advisory
support.apple.com/kb/HT213494Third Party Advisory
support.apple.com/kb/HT213493Third Party Advisory
seclists.org/fulldisclosure/2022/Oct/41Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2022/Oct/28Mailing List
seclists.org/fulldisclosure/2022/Oct/30Mailing List

Show all 32 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities