Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability in IOSurfaceAccelerator Allowing Arbitrary Code Execution with Kernel Privileges

A vulnerability allowing an out-of-bounds write has been identified in the IOSurfaceAccelerator component of Apple iOS, iPadOS, and macOS. This issue could enable an application to execute arbitrary code with kernel privileges. The vulnerability arises from insufficient input validation. Apple has acknowledged reports of active exploitation of this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated privileges, potentially allowing for significant system compromise.

Remediation

Users can update to the latest versions of macOS Monterey 12.6.5, macOS Big Sur 11.7.6, iOS 16.4.1, iPadOS 16.4.1, or iOS 15.7.5 and iPadOS 15.7.5. Instructions for updating can be found on the Apple Support website.