CVE-2022-32786

Vulnerability

The vulnerability exists in the handling of environment variables within macOS. Insufficient validation allows an app to manipulate environment variables in a way that bypasses file system protections. Affected versions: macOS Monterey before 12.5, macOS Big Sur before 11.6.8, and macOS Catalina before Security Update 2022-005 [1][2][3].

Exploitation

An attacker would need to have the ability to run an app on the affected system. No special privileges are required beyond the ability to execute code. The app can set or modify environment variables in a manner that leads to bypassing file system restrictions, enabling modification of protected parts of the file system.

Impact

Successful exploitation allows an app to modify protected parts of the file system, potentially leading to data corruption, privilege escalation, or system instability. The impact is limited to file system modification; the description does not indicate arbitrary code execution or kernel compromise.

Mitigation

Apple released fixes in macOS Monterey 12.5, macOS Big Sur 11.6.8, and Security Update 2022-005 Catalina on July 20, 2022 [1][2][3]. Users should update to the latest available versions. No workarounds are documented.