CVE-2022-26698

Vulnerability

An out-of-bounds read vulnerability exists in the processing of AppleScript binaries on macOS. The issue is present in versions prior to Security Update 2022-004 for Catalina, macOS Big Sur 11.6.6, and macOS Monterey 12.4. Processing a maliciously crafted AppleScript binary triggers an out-of-bounds read due to insufficient bounds checking.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted AppleScript binary to a target user. No special network position or authentication is required; the attacker must only convince the user to process the malicious binary (e.g., by opening a file or running a script). The out-of-bounds read occurs during parsing of the binary.

Impact

Successful exploitation can result in unexpected application termination (denial of service) or disclosure of process memory, potentially leaking sensitive information. The vulnerability does not grant code execution or privilege escalation based on the available description.

Mitigation

Apple addressed this issue in Security Update 2022-004 for macOS Catalina, macOS Big Sur 11.6.6, and macOS Monterey 12.4, all released on May 16, 2022 [1][2][3]. Users should update to the latest available version for their macOS release. No workarounds are documented.