TI-2022-09979 Aliases CVE-2022-26724 GHSA-39rg-8h92-xq56

Improper authentication in Apple tvOS

LOW 24CWE-287Published 2022-05-26 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication.

Why it matters now

EPSS 0.00227 13th percentileScored 2026-11-07

Fix Fixed tvOS (Apple): 15.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	tvOS	before 15.5	15.5	Patch available	CNA

tvOS VendorApple Affected before 15.5 Fixed in 15.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:apple:tvos::::::::	before 15.5	Vulnerable	Apple

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 15.5 Vulnerable ·Apple

Remediation

Fix · CNA tvOS (Apple) Fixed in 15.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-05-26
Apple tvOS 15.5
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2022-09986 Out-of-bounds write in Apple tvOSPriority LOW 37
- TI-2022-09990 Out-of-bounds write in Apple tvOSPriority LOW 36
- TI-2022-09989 Out-of-bounds write in Apple tvOSPriority LOW 36
Show all 7 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-26724
2026-10-03 Alias added: GHSA-39rg-8h92-xq56

References

Advisory 1

https://support.apple.com/en-us/HT213254

TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2025-28228 Use after free in Apple Safari KEVCVSS 3.1HIGH 8.8
TI-2025-22512 Memory corruption in Apple Safari KEVCVSS 3.1HIGH 8.8
TI-2025-12953 Memory corruption in Google Chrome KEVCVSS 3.1HIGH 8.8

See all 2228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences