CVE-2022-26704: Input Validation

Published May 16, 2022
·
Updated

A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.

Other sources

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

— Apple

AccessorySetupKit. An authentication issue was addressed with improved state management.

— Apple

Accounts. A logging issue was addressed with improved data redaction.

— Apple

Accounts. A path handling issue was addressed with improved validation.

— Apple

Accounts. This issue was addressed with additional entitlement checks.

— Apple

Credit

Joshua Mason(Mandiant), Gergely Kalman@@gergely_kalman(Mandiant), (Mandiant), Arsenii Kostromin (0x3c3e)(Microsoft), Jonathan Bar Or(Microsoft), Wojciech Reguła@@_r3ggi(SecuRing), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), Yuebin Sun@@yuebinsun2020(Tencent Security Xuanwu Lab), Max Shavrick@@_mxms(the Google Security Team), Zubair Ashraf(Crowdstrike), CVE-2022-0778, CVE-2022-23308, Paul Walker(Bury), Nathaniel Ekoniak(Ennate Technologies), Mickey Jin@@patch1t, @@gorelics, an anonymous researcher, Linus Henze(Pinauten GmbH), Peter Nguyễn Vũ Hoàng(STAR Labs), Felix Poulin-Belanger, Antonio Cheong Yu Xuan(YCISCQ), Arsenii Kostromin (0x3c3e), Ron Waisberg(SecuRing), an anonymous researcher(SecuRing), (Perception Point), Ron Hass@@ronhass7(Perception Point), ryuzaki, Chijin Zhou(ShuiMuYuLin Ltd), Tsinghua wingtecher lab, Jeonghoon Shin(Theori), SorryMybad@@S0rryMybad(Kunlun Lab), Dongzhuo Zhao(ADLab of Venustech), Scarlet Raine, Wang Yu(Cyberserval), CVE-2022-0530, Tavis Ormandy, CVE-2021-45444, Yonghwi Jin@@jinmo123(Theori), actae0n(Blacksun Hackers Club working with Trend Micro Zero Day Initiative), Andrew Williams(Google), Avi Drissman(Google), Liu Long(Ant Security Light), Antonio Zekic@@antoniozekic, Jeonghoon Shin(Theori working with Trend Micro Zero Day Initiative), Jack Dates(RET2 Systems Inc), chenyuwang@@mzzzz__(Tencent Security Xuanwu Lab), Jordy Zomer@@pwningsystems, Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs), Ned Williamson(Google Project Zero), Jon Thompson(Evolve), IA), ABC Research s.r.o, CVE-2021-44224, CVE-2021-44790, CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Qi Sun(Trend Micro), Robert Ai(Trend Micro), Ye Zhang@@co0py_Cat(Baidu Security), Hcamael, 章鱼哥 (aipyaipy.com)@@aipy, Rahul Raj, @@Licht_jb, lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx@@r3pwnx, Lily Cohl@@GenericCoding, Nathaniel Oh@@calysteon, Marco Schmitt(Calif), Andrey Chernykh(Calif), Josh Maine(Calif), Franco Belman at Blackwing Intelligence, Chris Bailey - Short Circuit, Neon, Niels Hofmans, Mustafa Calap@@ordinal0, dbg.re), Ivan Fratric(Google Project Zero), N.M.Praveen Nawarathne@@zblockrat, Mateusz Jurczyk(Google Project Zero), Meta Red Team X - Nik Tsytsarkin, Tucker Willenborg, Stuart Wallace, an anonymous researcher(Calif), 章鱼哥 (aipyaipy.com)@@aipy(Calif), Roman Zabicki(Calif), Anna Groza@@pwnlambda(Calif), Meta Product Security, Përparim Mjeku, Altin Gashi, f4&Zhiniang Peng with HUST(Calif), Aobo Wang@@M4x_1997(Calif), Xiang Chen(Calif), Jakob Pammer(Calif), Substrate, Stefan Esser (Calif), Adriatik Raci(Lupus Nova), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), 정우 하@@0xfa11babe, Nurihan Kim (HanTul)(TrendAI Zero Day Initiative), R4mbb(Lupus Nova), Somair Ansar, Abodi Dawoud, D4rthL, Roman Zabicki(Talence Security), Tristan Madani@@TristanInSec(Talence Security), Jihwan Yoon, Yash Pandya, Parth Raval, Garin R, sh3rlock (김보겸), Nik Tsytsarkin, PETOWORKS의 Bugeun Choi@@Bugeun(Google Project Zero), Rahul Raj(Google Project Zero), Piotr Jerzy Duszynski(Google Project Zero), Charles Stevenson, Seung Je Seong, Mathis Mansière, Bhuwan Bhetwal(Braze Security Team), Kwak Kiyong@@Pwnkai23(Braze Security Team), Song Nuri(Braze Security Team), Nicolas Seriot(Braze Security Team), Tommy DeVoss@@thedawgyg(Braze Security Team), Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana, Pedro Pinho, Wang Yu, Nebula Security@@nebusecurity(Aginor), Tim Michaud@@TimGMichaud(Aginor), Xinru Chi(Pangu Lab), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, greenbynox, Marc Newlin(SkySafe), OpenAI, Arnold Cartagena(Tolmo), Matt Suiche@@msuiche(Tolmo), Will Estes, Jerry L. Knot, Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran, Vinay Kumar Rasala (Xplo8E)(Appknox), CVE-2026-112500, Daniel Rodríguez, Sindre Sorhus, Abodi Dawoud(Lupus Nova), Zhongquan Li@@Guluisacat(Positive Technologies), Ilya Andr (andrd3v)(Positive Technologies), Azize Rhounam, Mahmoud Abdelmoniem, Zhongcheng Li (CK01)(Positive Technologies), Musaab Khan@@bxff, Saoud Khalifah, stratan@@5tratan, ret2happy@@ret2happy, 진규정 (Gyujeong Jin(DEVCORE Research Team), @@G1uN4sh(DEVCORE Research Team), Lucas Parnell(DEVCORE Research Team), ret2happy@@ret2happy(DEVCORE Research Team), Meta Red Team X - Nik Tsytsarkin(DEVCORE Research Team), YingMuo@@YingMuo(DEVCORE Research Team), Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Varik Matevosyan@@D4RK7ET, Prafull Dhiman, Alto_00000, JeongAhn Jang(sentry), Alto_00000(sentry), Nicolas Seriot(sentry), 김도현(sentry), Abodi Dawoud(sentry), Drin Raci(sentry), Jakob Pammer(Appknox), Stuart Wallace(Appknox), hamayanhamayan(Appknox), Ilya Andr (andrd3v), Hongsik Kim (mnur), Narendra Singh@@_3P1C, Yujung Choi@@Dusker, Robert Mindo, Stav Nir, Vladimir Tokarev, Aditya Kumar, Lucas Lammer, silo, Gergely Kalman@@gergely_kalman, zenith, Santiago Albertengo, Wesley Wineberg, Rotce(SkySafe), Sandeep Wawdane (thecybersandeep)(SkySafe), Ankur Saini(Volexity), Kwak Kiyong@@Pwnkai23, Song nuri, Do Young Park (adawn), MYUNGYONG LEE, Luke Francis@@lukefr09, Shubham Chaskar, Kwak Kiyong, Song Nuri, Avinash Kumar Thapa & Jay Kaushik Patel, Hossein Lotfi@@hosselot(TrendAI Zero Day Initiative), 은태 장, Franz Bettag, OpenAI Codex Security - Amy Burnett, Euntae Jang, pwn2addr, Gia Bui@@yabeow(Calif), Myungyong Lee, remanone@@remanone_, Josef Korbel (Citadelo), Charles Kern, Malik M.@@m411k_, Chris Rohlf with Anthropic Research, Drinor Selmanaj (Sentry), Eddy Tsalolikhin, Luke Francis, Jackson Kuja, Bhaswanth Chigurupati, LiangWei, Huy Nguyen@@34306(Calif), Johnny Franks@@0xjohnny, Daniel, KennethLi, Jaebin Sim (simjabin.com)@@gmail, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Richard Hyunho Im at Route Zero Security@@richeeta, Jaeyeong Lee, Dohyeon An Technology Inc@@PILAB, Chanwit Muenprakoddee (ChemIndy), Lance Cain - Senior Security Researcher at SpecterOps Inc., Paul Montgomery@@nullevent, Lakshay Sharma (MrW0r57), 준우 이, Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Frederick Kaludis (Coiffeur0x90)(Nosebeard Labs), DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, Zwei Tasse Kaffee, Jakob Pammer, Jay K Patel, Jay J Patel, Jay Patel, Thanatos Tian (HKPolyU) & wgg with Diffract, Frederick Kaludis (Coiffeur0x90)(DBAppSecurity's WeBin lab), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Lakshay Sharma (MrW0r57)/WorstCase Labs.(Iru), Ashish Kavishwar(Iru), Csaba Fitzl@@theevilbit(Iru), Sanny Mitra, Alfredo Pesoli@@__rev(Bynar), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Lyutoon, Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda, Christian Niel Angel(Protectiv IT Security Inc), powerprove(SecuRing), Wojciech Regula(SecuRing), R4mbb, Michael Benich, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt, Sattyam Yadav(Protectiv IT Security Inc), onetwo(Protectiv IT Security Inc), Robert Tran(Protectiv IT Security Inc), Merrick Hare(Protectiv IT Security Inc), @@pixiepointsec, Sihyun Roh (Compsec, SNU), Andrey Chernykh, Nord0x, f0r(MurphySec), Yiğit Can YILMAZ@@yilmazcanyigit, Jonathan Bar Or@@yo_yo_yo_jbo, Aidan Hunt (forgechroma.com), Siddharth Aeri, Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), 도현 김, YEONGJAE SHIN, Ithrael, OSORI(Iru), wdszzml(Iru), Atuin Automated Vulnerability Discovery Engine(Iru), ruitong@@abstract, Efstratios Kaplanellis@@5tratan(Almamater Technologies), 준우 이(Colorado Boulder), an anonymous researcher(Colorado Boulder), Ruitong (Abstract Lab(Colorado Boulder), University(Colorado Boulder), an anonymous researcher(Nosebeard Labs), 도현 김(Nosebeard Labs), Junyeong Lee (jylab.github.io)(Nosebeard Labs), Niels Hofmans(Nosebeard Labs), Jonghoon Han (Aegis), f4&Zhiniang Peng with HUST, Geonha Lee@@leegn4a, Arni Hardarson (Neonix Security), YUJUNG CHOI@@Dusker, koocolb, Alfredo Pesoli via Bynario Atlas (bynar.io)@@__rev, cnitlrt@@abstract(Sentry), Roman Belovitskiy(Sentry), Lyutoon(Sentry), Art Pllana(Sentry), Redon Gashi(Sentry), Teodor Sorescu@@teodorsorescu, lokerxx, Phillip Groves, cnitlrt@@abstract, Albin Haliti, Bhuwan Bhetwal(ThreatBook), Feng Xue(ThreatBook), XGPT(ThreatBook), Nathaniel Oh@@calysteon(Talence Security), an anonymous researcher(Talence Security), Narendra Singh@@_3P1C(Talence Security), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Maher Azzouzi(Nosebeard Labs), Frederick Kaludis (Coiffeur0x90), Mufeed VH(Winfunc Research), Ryan Dowd@@_rdowd, 云开 江, Joshua Maina, Mahmoud Gamal@@Zombiehelp54, Thanatos Tian (HKPolyU) & wgg & 2st with Diffract, Aswin Kumar Gokula Kannan, David Krehwinkel, Ricardo Prado, Nguyen Duc Anh(Noventiq), Maher Azzouzi, Bhuwan Bhetwal, Kwak kiyong@@Pwnkai23, Ruslan Dautov, Thomas Guillem, We Muftihaturrahmah

Affected Software

30 affected componentsFixes available
Apple macOS Big Sur<11.6.8
11.6.8
Apple Catalina
Apple macOS Monterey<12.4
12.4
Apple iOS and macOS>=10.15<10.15.7
Apple iOS and macOS=10.15.7
Apple iOS and macOS=10.15.7-security_update_2020
Apple iOS and macOS=10.15.7-security_update_2020-001
Apple iOS and macOS=10.15.7-security_update_2020-005
Apple iOS and macOS=10.15.7-security_update_2020-007
Apple iOS and macOS=10.15.7-security_update_2021-001
Apple iOS and macOS=10.15.7-security_update_2021-002
Apple iOS and macOS=10.15.7-security_update_2021-003
Apple iOS and macOS=10.15.7-security_update_2021-004
Apple iOS and macOS=10.15.7-security_update_2021-005
Apple iOS and macOS=10.15.7-security_update_2021-006
Apple iOS and macOS=10.15.7-security_update_2021-007
Apple iOS and macOS=10.15.7-security_update_2021-008
Apple iOS and macOS=10.15.7-security_update_2022-001
Apple iOS and macOS=10.15.7-security_update_2022-002
Apple iOS and macOS=10.15.7-security_update_2022-003
Apple iOS and macOS=10.15.7-security_update_2022-004
Apple macOS>=11.0<11.6.8
Apple macOS>=12.0.0<12.4
Apple iOS<15.5
15.5
Apple iPadOS<15.5
15.5
Apple iOS<27.2
27.2
Apple iPadOS<27.2
27.2
Apple WatchOS<27.2
27.2
Apple visionOS<27.2
27.2
Apple macOS Golden Gate<27.2
27.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Apple macOS to a version that resolves this vulnerability.

    Fixed in 11.6.8
  2. Upgrade

    Upgrade macOS to a version that resolves this vulnerability.

    Fixed in 12.4
  3. Upgrade

    Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.

    Fixed in 15.5
  4. Upgrade

    Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.

    Fixed in 15.5
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.4
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 27.2
  7. Upgrade

    Upgrade apache to a version that resolves this vulnerability.

    Fixed in 2.4.53
  8. Upgrade

    Upgrade macOS Monterey to a version that resolves this vulnerability.

    Fixed in 12.4
  9. Configuration

    Enable hardened runtime.

    hardened runtime = enabled

Event History

May 16, 2022
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
May 26, 2022
CVE Published
via MITRE·06:43 PM
Data Sourced
via MITRE·06:43 PM
DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2022-26704?

CVE-2022-26704 is a vulnerability related to a validation issue in the handling of symlinks in Apple Spotlight.

2

How does CVE-2022-26704 affect Apple software?

CVE-2022-26704 affects Apple software including macOS Big Sur (up to version 11.6.8) and macOS Monterey (up to version 12.4).

3

What is the severity of CVE-2022-26704?

The severity of CVE-2022-26704 has not been specified.

4

How can I fix CVE-2022-26704?

To fix CVE-2022-26704, update your Apple software to the recommended versions: macOS Big Sur 11.6.8 or macOS Monterey 12.4.

5

Where can I find more information about CVE-2022-26704?

More information about CVE-2022-26704 can be found on the Apple support page: [https://support.apple.com/en-us/HT213257](https://support.apple.com/en-us/HT213257)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203