How to Fix CVE-2022-32893: Remote Code Execution in Safari, iOS and iPadOS, macOS

Patch immediately. This is an actively exploited WebKit memory-corruption bug. Update to iOS/iPadOS 15.6.1, macOS Monterey 12.5.1, or Safari 15.6.1 right now. CISA listed it in the Known Exploited Vulnerabilities catalog on 2022-08-18 with a federal remediation deadline of 2022-09-08. Because the bug lives in the browser engine, the only thing an attacker needs is for you to load a malicious web page.

What is CVE-2022-32893?

CVE-2022-32893 is an out-of-bounds write (CWE-787) in WebKit, the browser engine that powers Safari and every web view on iOS and iPadOS. Apple's advisory states it plainly: “An out-of-bounds write issue was addressed with improved bounds checking… Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.” It was published on 2022-08-24 and assigned by Apple.

An out-of-bounds write means WebKit, while parsing attacker-controlled web content, writes data past the end of an allocated buffer. That corrupts adjacent memory the engine never intended to touch. A skilled attacker shapes the heap so the corrupted bytes land on a useful target, a function pointer, a length field, an object's type tag: and turns the memory bug into arbitrary code execution inside the content process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects this exactly: network-reachable, low complexity, no privileges needed, but it does require the victim to open a page (UI:R).

This is not a server flaw and not a service you firewall off. There is no listening port. The attack surface is the web content itself, which is why Apple shipped it as a same-day point release across iOS, iPadOS, macOS, and Safari, and later backported it to the legacy iOS 12 line as iOS 12.5.6. On Linux, the same WebKit defect was tracked downstream in WebKitGTK and WPE WebKit under advisory WSA-2022-0008, and patched by Debian (DSA-5219, DSA-5220), Fedora, and Gentoo (GLSA-202208-39).

Why this matters

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-08-18, six days before Apple's own advisory date. under the title “Apple iOS and macOS Out-of-Bounds Write Vulnerability.” That listing exists because at least one confirmed in-the-wild exploitation report was filed. CISA's SSVC assessment records Exploitation: active and Technical Impact: total, with Automatable: no (the UI:R requirement means it needs a victim to visit a page, so it is not wormable).

The realistic threat model is a watering-hole or targeted link: a user opens a crafted page in Safari, or any in-app web view on iOS/iPadOS, and the attacker gets code execution in the content sandbox. This CVE shipped alongside CVE-2022-32894, a companion kernel out-of-bounds write fixed in the same builds, a classic two-bug exploit chain where the WebKit RCE breaks into the renderer and the kernel bug escalates to full device compromise. Treat any device on an affected build as a live target, not a maybe.

Signal review

You are exposed if any device runs a build older than the patched release for its platform:

• iPhone / iPad: Settings → General → About → check Software Version. Vulnerable if below 15.6.1 (or below 12.5.6 on the legacy iOS 12 line for older hardware).
• Mac: Apple menu → About This Mac. Vulnerable if macOS Monterey is below 12.5.1. Big Sur and Catalina received their fixes via separate Safari updates: Safari must be 15.6.1.
• Standalone Safari on older macOS: Safari → About Safari. Vulnerable below 15.6.1.
• Linux desktops: any app embedding WebKitGTK or WPE WebKit before the WSA-2022-0008 fix (check your distro's webkit2gtk package version).

Because the flaw is in the rendering engine, every browser on iOS is affected, not just Safari, third-party browsers on iOS are required to use WebKit, so Chrome and Firefox on iPhone/iPad were equally vulnerable until the OS was updated.

How to fix CVE-2022-32893

There is one real remediation: install Apple's patched build. There is no configuration toggle and no server-side mitigation, because the vulnerable code runs the moment a page renders.

Update iPhone and iPad (iOS / iPadOS 15.6.1)

1. Open Settings → General → Software Update.
2. Install iOS 15.6.1 / iPadOS 15.6.1 (or a later release. every build after this is also patched).
3. On older devices that top out at iOS 12, install iOS 12.5.6 (Apple's backport for this CVE).
4. For managed fleets, push the update through MDM. The Intune/Graph check below flags any device still on an affected build.

# Microsoft Intune / Graph: find managed Apple devices still below the patched builds.
# Vendor advisory (iOS/iPadOS 15.6.1): https://support.apple.com/en-us/HT213414
Connect-MgGraph -Scopes DeviceManagementManagedDevices.Read.All
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'iOS'" -All |
  Where-Object { [version]($_.OsVersion) -lt [version]'15.6.1' } |
  Select-Object DeviceName, OsVersion, UserPrincipalName

Update macOS Monterey (12.5.1) and Safari (15.6.1)

1. On macOS Monterey: Apple menu → System Preferences → Software Update, then install macOS 12.5.1.
2. On Big Sur or Catalina (still supported in 2022): the WebKit fix arrives as the standalone Safari 15.6.1 update via Software Update.
3. Quit and reopen Safari and any open browsers after the update so they reload the patched engine.

Update WebKitGTK / WPE WebKit on Linux

# Debian / Ubuntu, pull the patched webkit2gtk (DSA-5219 / DSA-5220 / DLA 3087-1)
sudo apt-get update
sudo apt-get install --only-upgrade libwebkit2gtk-4.0-37 libwebkit2gtk-4.1-0

# Fedora
sudo dnf upgrade --refresh webkit2gtk4.0 webkit2gtk4.1

# Verify the installed WebKitGTK version carries the WSA-2022-0008 fix
apt-cache policy libwebkit2gtk-4.0-37    # Debian/Ubuntu
rpm -q webkit2gtk4.0                      # Fedora

After upgrading WebKitGTK, restart any long-running apps that embed it (GNOME Web/Epiphany, mail clients with HTML rendering, Electron-adjacent GTK apps) so they load the patched library.

Verify the fix landed

1. iOS/iPadOS: Settings → General → About → Software Version reads 15.6.1 or higher (or 12.5.6 on the legacy line).
2. macOS: About This Mac shows 12.5.1 or higher; Safari → About Safari shows 15.6.1 or higher.
3. Fleet: re-run the Intune/Graph query above: it should return zero rows.
4. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable). It should no longer flag CVE-2022-32893 on the host.

If you can't patch immediately

Apple published no workaround for this CVE, bounds checking inside WebKit is not something you can toggle off, and there is no setting that blocks the malicious content path while leaving the browser usable. Until the device is updated, the only meaningful reductions in risk are behavioral:

• Avoid untrusted links. Do not open unexpected links, especially from messages and email, on an unpatched device.
• Use Lockdown Mode if you are a high-risk target on a device that supports it (it hardens WebKit's attack surface), though the real fix is still the update.
• Take the device off daily use for genuinely sensitive accounts until it is patched.

There is no firewall rule, VPN, or network control that mitigates a client-side browser-engine bug. Patching is the remediation.

Repair sequence

1. Confirm the running build matches a patched release (15.6.1 / 12.5.1 / Safari 15.6.1, or 12.5.6 on legacy iOS).
2. Reopen Safari and other browsers so they load the patched engine.
3. For managed fleets, re-run the MDM query and re-scan with your vulnerability scanner.
4. If a device was used to open suspicious content while unpatched, treat it as a possible compromise. back up data, and for high-value targets consider an erase-and-restore rather than an in-place update.

Is CVE-2022-32893 actually being exploited?

Yes. Apple states it “may have been actively exploited,” and CISA added it to the KEV catalog on 2022-08-18 with active-exploitation status. It commonly appeared paired with CVE-2022-32894 (a kernel bug fixed in the same builds) as a renderer-to-kernel exploit chain.

Which exact version fixes it?

iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Older iPhones/iPads on the iOS 12 line get the fix in iOS 12.5.6. On Linux, the WebKitGTK/WPE fix is tracked as WSA-2022-0008 (Debian DSA-5219/DSA-5220, Fedora, Gentoo GLSA-202208-39).

I don't use Safari on my iPhone, am I still affected?

Yes. Every browser and in-app web view on iOS is required to use WebKit, so Chrome, Firefox, and any app that opens web content were vulnerable until the OS was updated. Switching browsers does not help; only the OS/Safari update does.

Do I need to wipe a device that was on an old build?

For a normal user device that wasn't targeted, simply updating to 15.6.1 / 12.5.1 closes the hole. For high-risk targets or any device you suspect opened a malicious page, back up and erase-and-restore is the safer call, since successful exploitation could have run code in the content process.

References

• Official vendor advisory: https://support.apple.com/en-us/HT213414
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-32893
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV entry: "Apple iOS and macOS Out-of-Bounds Write Vulnerability" - added 2022-08-18

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2022-42827: Denial of Service in iOS and iPadOS
• How to Fix CVE-2022-22587: Denial of Service in iOS and iPadOS, macOS
• How to Fix CVE-2022-42856: Remote Code Execution in tvOS
• How to Fix CVE-2022-48618: Denial of Service in Apple iOS and iPadOS
• How to Fix CVE-2022-32894: Denial of Service in iOS and iPadOS, macOS