CVE-2022-42915: apple macos Double Free
Vulnerability summary
CVE-2022-42915 is a high (CVSS 8.1) Double Free vulnerability in apple macos. EPSS estimates a 2.93% chance of exploitation in the next 30 days, higher than 86.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 29-10-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.93%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
-0.21 pp
From 3.14% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp5 products
Alpine1 product
- curl≥ 7.77.0, < 7.80.0-r4 | ≥ 7.77.0, < 7.83.1-r4 | ≥ 7.77.0, < 7.86.0-r0
Apple1 product
- macos≥ 12.0.0, < 12.6.3 | ≥ 13.0, < 13.2
Debian1 product
- curl< 7.86.0-1
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Haxx1 product
- curl≥ 7.77.0, < 7.86.0
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curl< 7.81.0-1ubuntu1.6
8 vendors · 12 products
References
18 links- security.netapp.com/advisory/ntap-20221209-0010/Third Party Advisory
- support.apple.com/kb/HT213604Third Party Advisory
- support.apple.com/kb/HT213605Third Party Advisory
