CVE-2022-26720

Vulnerability

An out-of-bounds write vulnerability exists in the macOS kernel. A malicious application can trigger this memory corruption issue, leading to arbitrary code execution with kernel privileges. The issue affects macOS Monterey before version 12.4, macOS Big Sur before version 11.6.6, and macOS Catalina before Security Update 2022-004 [1][2][3].

Exploitation

An attacker requires the ability to run a malicious application on the target system. No additional privileges or user interaction beyond launching the application are necessary. The application triggers the out-of-bounds write by exploiting the flawed bounds checking in the kernel code.

Impact

Successful exploitation allows the attacker to execute arbitrary code with kernel privileges, resulting in full compromise of the system's confidentiality, integrity, and availability.

Mitigation

Apple addressed this issue in macOS Monterey 12.4, macOS Big Sur 11.6.6, and Security Update 2022-004 for Catalina, all released on May 16, 2022 [1][2][3]. No workarounds are available; users should apply the updates promptly.