CVE-2022-26704

A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.

Published: May 26, 2022
Updated: Apr 14, 2023
CVE: CVE-2022-26704
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.8
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-59

Affected Software
References

Vulnerability Database

289,599

CVE-2022-26704

Software	From	Fixed in
apple / mac_os_x	10.15	10.15.7
apple / mac_os_x	10.15.7-security_update_2020-005	10.15.7-security_update_2020-005.x
apple / mac_os_x	10.15.7-security_update_2020-007	10.15.7-security_update_2020-007.x
apple / mac_os_x	10.15.7	10.15.7.x
apple / mac_os_x	10.15.7-security_update_2020-001	10.15.7-security_update_2020-001.x
apple / mac_os_x	10.15.7-security_update_2020	10.15.7-security_update_2020.x
apple / mac_os_x	10.15.7-security_update_2021-001	10.15.7-security_update_2021-001.x
apple / mac_os_x	10.15.7-security_update_2021-002	10.15.7-security_update_2021-002.x
apple / mac_os_x	10.15.7-security_update_2021-003	10.15.7-security_update_2021-003.x
apple / mac_os_x	10.15.7-security_update_2021-004	10.15.7-security_update_2021-004.x
apple / mac_os_x	10.15.7-security_update_2021-005	10.15.7-security_update_2021-005.x
apple / mac_os_x	10.15.7-security_update_2021-006	10.15.7-security_update_2021-006.x
apple / mac_os_x	10.15.7-security_update_2021-008	10.15.7-security_update_2021-008.x
apple / mac_os_x	10.15.7-security_update_2021-007	10.15.7-security_update_2021-007.x
apple / mac_os_x	10.15.7-security_update_2022-002	10.15.7-security_update_2022-002.x
apple / mac_os_x	10.15.7-security_update_2022-001	10.15.7-security_update_2022-001.x
apple / mac_os_x	10.15.7-security_update_2022-003	10.15.7-security_update_2022-003.x
apple / macos	12.0.0	12.4
apple / mac_os_x	10.15.7-security_update_2022-004	10.15.7-security_update_2022-004.x
apple / macos	11.0	11.6.8