Actively exploited in the wild
Apple iOS Type Confusion Vulnerability
Apple - iOS · Listed in the CISA KEV since 2022-12-14. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-42856
HighCVSS 8.8KEVSummary
A type confusion issue in Safari, iOS, iPadOS, macOS, and tvOS. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of reports that this issue may have been actively exploited.
Risk Assessment
An attacker could execute arbitrary code on the victim's device, potentially leading to device takeover and data theft.
Recommendation
Update Apple systems to the latest versions (Safari 16.2, iOS 16.1.2, iPadOS 16.1.2, macOS Ventura 13.1, tvOS 16.2) and avoid visiting suspicious websites.
Other vulnerabilities in Apple Safari
See all- CVE-2015-5780High
The Safari Extensions implementation in Apple Safari before version 9 does not require user confirmation before replacing an installed extension, which may lead to unspecified impacts and attack vectors.
- CVE-2014-1303High
A heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism.
- CVE-2014-1300High
An unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors.
- CVE-2019-8506HighActively exploited
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112684Low risk· EPSS 9%
A state management issue in the web content processing component. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2026-112680Low risk· EPSS 7%
An out-of-bounds read in the web content processing component, addressed with improved bounds checking. Processing maliciously crafted web content may result in the disclosure of process memory.
- CVE-2026-112673Low risk· EPSS 9%
A type confusion issue in web content processing, addressed with improved state handling. The flaw affects Safari, iOS, iPadOS, macOS and visionOS. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112669Low risk· EPSS 9%
A race condition issue, addressed with improved state handling. It affects Safari, iOS, iPadOS, macOS, tvOS and watchOS. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-112666Low risk· EPSS 8%
A use-after-free issue, addressed with improved memory management. It affects Safari, iOS, iPadOS, macOS, tvOS and watchOS. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-65391High
An out-of-bounds write vulnerability in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.
Original NVD description (English source)
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
Vulnerability data from NVD (NIST) · CISA KEV · EPSS