CVE-2022-22610

What it actually does

Memory corruption triggered by processing malicious web content leads to arbitrary code execution in the affected process.

Why it matters to the business

Attackers can gain full control of user devices or systems that render untrusted web content, enabling data theft, malware deployment, or further network compromise; the issue affects a widely used library with many downstream dependents.

How an attack unfolds

An attacker hosts or delivers maliciously crafted web content; when a victim processes it in a vulnerable client, the memory corruption is triggered and leveraged for code execution. No named threat actors or ransomware campaigns are associated with this flaw.

How to fix it

Upgrade curl to the fixed commit 7161cb17c01dcff1dc5bf89a18437d9d729f1ecd or apply equivalent patches in downstream products; for Apple platforms update to macOS Monterey 12.3, Safari 15.4, iOS 15.4, iPadOS 15.4, watchOS 8.5 or tvOS 15.4.

How to confirm the fix worked

Confirm the installed version matches or exceeds the fixed commit or Apple platform releases; test rendering of known proof-of-concept payloads in a controlled environment to verify the crash or corruption is no longer reproducible.

Typical attack path

1. Craft malicious web content exploiting the memory corruption
2. Host or deliver the content via phishing, compromised sites, or drive-by download
3. Victim opens or renders the content in an affected client
4. Memory corruption occurs and is chained to achieve code execution

How to detect it

Review web browser and client application logs for unexpected crashes or memory errors when processing web content; examine process execution and network traffic for anomalous behavior following visits to suspicious sites.

What your security team should do

• Prioritize patching curl and Apple clients to the listed fixed versions within standard change windows
• Monitor EPSS trend (currently rising) and reassess priority if exploit maturity increases
• Block or sandbox rendering of untrusted web content where possible until patches are deployed