CVE-2022-1622: Apple iPhone OS

Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days.

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.

Affected products

• Apple iPhone OS: before 16.0 (fixed in 16.0)
• Apple macOS: from 11.0, before 11.7 (fixed in 11.7); from 12.0, before 12.6 (fixed in 12.6)
• Apple tvOS: before 16.0 (fixed in 16.0)
• Apple watchOS: before 9.0 (fixed in 9.0)
• Fedoraproject Fedora: version 35 only; version 36 only
• Libtiff Libtiff: version 4.3.0 only
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified

Published 2022-05-11. Last modified 2026-06-17.