CVE-2022-26775

Vulnerability

An integer overflow vulnerability exists in macOS due to improper input validation. This issue affects macOS Monterey versions prior to 12.4 and macOS Catalina before Security Update 2022-004. The overflow can occur when processing crafted data in an unspecified component [1][3].

Exploitation

A local attacker may exploit the integer overflow by providing specially crafted input to the affected component. No special privileges or user interaction beyond local access are required. The overflow can lead to memory corruption, which the attacker can leverage for code execution [1][3].

Impact

Successful exploitation could cause immediate application termination (denial of service) or arbitrary code execution at the privilege level of the vulnerable application. If the application runs with elevated privileges, the attacker could gain those privileges. The impact includes potential full compromise of the system's confidentiality, integrity, and availability [1][3].

Mitigation

Apple has fixed this vulnerability in macOS Monterey 12.4 and Security Update 2022-004 Catalina, both released on May 16, 2022. Users are strongly advised to update to the latest versions. No known workarounds exist for unpatched systems [1][3].