CVE-2022-32935

Vulnerability

A lock screen state management issue in Apple iOS, iPadOS, and macOS allows a user to view restricted content from the lock screen. The vulnerability affects iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, and macOS Ventura 13 [1][2][3].

Exploitation

An attacker with physical access to a locked device can exploit this flaw to bypass the lock screen and view restricted content. No authentication is required beyond physical possession; the user may be able to interact with the device's lock screen to trigger the state management error.

Impact

Successful exploitation results in unauthorized disclosure of restricted content, such as notifications or other private information, from the lock screen. The compromise is limited to information viewing without elevation to code execution or persistent access.

Mitigation

Apple has addressed the issue in iOS 15.7.1, iPadOS 15.7.1 (released October 27, 2022), iOS 16.1 and iPadOS 16 (released October 24, 2022), and macOS Ventura 13 (released October 24, 2022) [1][2][3]. Users should update to the latest available versions. No workarounds are documented.