TI-2022-14369 Aliases CVE-2022-32835 GHSA-x64r-97x8-7c32

Information disclosure in Apple iOS

LOW 16CWE-200Published 2022-11-01 · Updated 2025-05-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

This issue was addressed with improved entitlements. This issue is fixed in iOS 16, watchOS 9. An app may be able to read a persistent device identifier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00258 17th percentileScored 2026-11-07

Fix Fixed iOS (Apple): 16watchOS (Apple): 9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	iOS	before 16	16	Patch available	CNA
Apple	watchOS	before 9	9	Patch available	CNA

iOS VendorApple Affected before 16 Fixed in 16 Patch available CNA
watchOS VendorApple Affected before 9 Fixed in 9 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:apple:iphone_os::::::::	before 16.0	Vulnerable	Apple
cpe:2.3:o:apple:watchos::::::::	before 9.0	Vulnerable	Apple

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 16.0 Vulnerable ·Apple
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 9.0 Vulnerable ·Apple

Remediation

Fix · CNA iOS (Apple) Fixed in 16
Fix · CNA watchOS (Apple) Fixed in 9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-11-01
Apple watchOS 9
18 records Highest priority Priority MEDIUM 3 MEDIUM, 15 LOW
Other records, highest priority first
- TI-2022-20811 Out-of-bounds write in Apple macOSPriority MEDIUM 43
- TI-2022-14415 Out-of-bounds write in Apple macOSPriority MEDIUM 43
- TI-2022-14429 Use after free in Apple iOSPriority MEDIUM 40
Show all 18 records →
Release · 2022-11-01
Apple iOS 16
8 records Highest priority Priority MEDIUM 1 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2022-14429 Use after free in Apple iOSPriority MEDIUM 40
- TI-2022-14433 Improper privilege management in Apple iOSPriority LOW 37
- TI-2022-14416 Apple iOS: An app may be able to execute arbitrary code with kernel privilegesPriority LOW 36
Show all 8 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-32835
2026-10-03 Alias added: GHSA-x64r-97x8-7c32

References

Advisory 2

TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2022-06854 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8

See all 4500 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences