CVE-2022-28739: Apple macOS

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

Affected products

• Apple macOS: from 11.0, before 11.7.1 (fixed in 11.7.1); from 12.0, before 12.6.1 (fixed in 12.6.1)
• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Ruby-Lang Ruby: before 2.6.10 (fixed in 2.6.10); from 2.7.0, before 2.7.6 (fixed in 2.7.6); from 3.0.0, before 3.0.4 (fixed in 3.0.4); from 3.1.0, before 3.1.2 (fixed in 3.1.2)

Published 2022-05-09. Last modified 2026-06-17.