CVE entry · CVE-2022-48503
CVE-2022-48503: Apple Multiple Products Unspecified Vulnerability
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Actively exploited: added to CISA’s KEV catalog on October 20, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 10, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes affected Apple products, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Apple vulnerabilities
-
Apple Multiple Products Out-of-Bounds Write Vulnerability
-
Apple macOS Improper Authentication Vulnerability
-
Apple Multiple Products Classic Buffer Overflow Vulnerability
-
Apple Multiple Products Improper Locking Vulnerability
-
Apple Multiple Products Buffer Overflow Vulnerability
-
Apple Multiple products Use-After-Free Vulnerability