CVE-2022-26746

Vulnerability

CVE-2022-26746 is a vulnerability in macOS that allows a malicious application to bypass Privacy preferences. The issue existed in an unspecified component and was addressed by removing the vulnerable code. Affected versions include macOS Monterey before 12.4, macOS Big Sur before 11.6.6, and macOS Catalina before Security Update 2022-004.

Exploitation

An attacker would need to have the ability to run a malicious application on the target system. No additional privileges or user interaction beyond launching the application are required. The exact exploitation steps are not disclosed, but the application could leverage the vulnerability to bypass Privacy preferences.

Impact

Successful exploitation allows the malicious application to bypass Privacy preferences, potentially gaining access to protected user data such as location, contacts, or other sensitive information that is normally restricted by Privacy controls.

Mitigation

Apple released fixes in macOS Monterey 12.4, macOS Big Sur 11.6.6, and Security Update 2022-004 for Catalina on May 16, 2022. Users should update to these versions. No workarounds are documented. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.