cbcvebase.
CVE-2022-48503
published 2023-08-14

CVE-2022-48503: The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6…

PriorityP186high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-11-10
Exploited in the wild
EPSS
3.21%
86.8th percentile
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

Affected

18 ranges
VendorProductVersion rangeFixed in
appleios_15.6_and_ipados
appleios_and_ipados>= unspecified < 15.615.6
appleipados< 15.615.6
appleiphone_os< 15.615.6
applemacos>= 12.0.0 < 12.512.5
applemacos>= unspecified < 12.512.5
applemacos_monterey
applesafari< 15.615.6
applesafari
applesafari>= unspecified < 15.615.6
appletvos< 15.615.6
appletvos
appletvos>= unspecified < 15.615.6
applewatchos< 8.78.7
applewatchos
applewatchos>= unspecified < 8.78.7
debianwebkit2gtk< webkit2gtk 2.38.0-1 (bookworm)webkit2gtk 2.38.0-1 (bookworm)
debianwpewebkit< webkit2gtk 2.38.0-1 (bookworm)webkit2gtk 2.38.0-1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

hash6eafd742f58db21fbaf5fd7636e6653446df04b4a5c9bca9104e5dfad34f547c
filenamef6lib.js
url*.min.js (binary payload delivery pattern)
bytes
0xf00dbeef
  • CVE-2022-48503 is internally codenamed 'jacurutu' in the Coruna exploit kit and targets iOS 15.2 through 15.5 as a WebContent R/W primitive; detection should focus on WebKit exploitation attempts in that version range.
  • The Coruna exploit kit delivers exploits via a hidden iFrame injected into compromised websites; network monitoring for hidden iFrame injection patterns on legitimate sites can surface delivery infrastructure.
  • The JavaScript obfuscation pattern using XOR-based character encoding (array.map with String.fromCharCode and XOR) is a unique fingerprint of the Coruna framework and can be used for JS-level detection.
  • Binary payloads encrypted with ChaCha20 and served with a .min.js URL extension, combined with the 0xf00dbeef magic header, can be used as a network/file-based detection signature for Coruna payload blobs.
  • The exploit kit bails out if Lockdown Mode or private browsing is detected; absence of exploitation attempts against Lockdown Mode devices can be used as a behavioral indicator to confirm Coruna activity.
  • The affected component is JavaScriptCore; security tooling should monitor for out-of-bounds memory access originating from JavaScriptCore when processing web content on unpatched iOS 15.2–15.5 devices.
  • ·The CVE-to-codename mapping in the exploit table is explicitly noted as preliminary; the 'jacurutu' codename association with CVE-2022-48503 may be revised as analysis continues.
  • ·All identified domains have been added to Google Safe Browsing, limiting their ongoing utility as network-based IOCs for detection in environments relying on that feed.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.