CVE-2022-32843

Vulnerability

An out-of-bounds write vulnerability exists in the Postscript file processing component of macOS. The issue arises from insufficient bounds checking when parsing a maliciously crafted Postscript file. Affected versions include macOS Monterey 12.5, macOS Big Sur 11.6.8, and macOS Catalina with Security Update 2022-005 [1][2][3].

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted Postscript file to the target user. No special network position or authentication is required; the user must open the malicious file using an application that processes Postscript data. Once opened, the out-of-bounds write is triggered during parsing.

Impact

Successful exploitation may result in unexpected application termination (denial of service) or disclosure of process memory, potentially leaking sensitive information. The description does not indicate arbitrary code execution or privilege escalation.

Mitigation

Apple addressed the issue in macOS Monterey 12.5, macOS Big Sur 11.6.8, and Security Update 2022-005 for Catalina, all released on July 20, 2022 [1][2][3]. Users should update to the latest available version. No workarounds have been published, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.