8.8

CVE-2022-48503: Apple Multiple Products Unspecified Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed
AliasesUBUNTU-CVE-2022-48503DEBIAN-CVE-2022-48503
Published 14-08-2023Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2022-48503 is a high (CVSS 8.8) Improper Validation of Array Index vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 20-10-2025. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
3.21%
0%100%
Low · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 4
DSA-5240-1DSA-5241-1MGASA-2023-0229RHSA-2023:2256RHSA-2023:2834RHSA-2024:9653

Timeline

  1. 14-08-2023
    PublishedVulnerability first disclosed.
  2. 20-10-2025
    Added to CISA KEVApple Multiple Products Unspecified Vulnerability
  3. 21-10-2025
    Last modifiedVulnerability information updated.
  4. 10-11-2025
    CISA remediation dueApply mitigations per vendor instructions.

Description

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

3.21%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.21% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.21%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
20-10-2025
Federal due date
10-11-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.apple.com/en-us/HT213340 support.apple.com/en-us/HT213341 support.apple.com/en-us/HT213342 support.apple.com/en-us/HT213345 support.apple.com/en-us/HT213346 nvd.nist.gov/vuln/detail/CVE-2022-48503

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apple7 products
Ubuntu5 products
  • qtwebkit-opensource-srcAll versions (No fix recorded)
  • qtwebkit-sourceAll versions (No fix recorded)
  • webkit2gtkAll versions (No fix recorded) | < 2.38.2-0ubuntu0.20.04.1 | < 2.38.2-0ubuntu0.22.04.2
  • webkitgtkAll versions (No fix recorded)
  • wpewebkitAll versions (No fix recorded)
Debian2 products
  • webkit2gtk< 2.38.0-1
  • wpewebkit< 2.38.0-1

3 vendors · 14 products

References

11 links
Show all 11 references