CVE-2022-37434: Apple iPadOS

Critical severity, CVSS 9.8. EPSS: 19% chance of exploitation in the next 30 days.

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected products

• Apple iPadOS: before 15.7.1 (fixed in 15.7.1)
• Apple iPhone OS: before 15.7.1 (fixed in 15.7.1); from 16.0, before 16.1 (fixed in 16.1)
• Apple macOS: from 11.0, before 11.7.1 (fixed in 11.7.1); from 12.0.0, before 12.6.1 (fixed in 12.6.1)
• Apple watchOS: before 9.1 (fixed in 9.1)
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci: affected versions not specified
• Netapp Hci Compute Node: affected versions not specified
• Netapp Management Services For Element Software: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Storagegrid: affected versions not specified
• Stormshield Stormshield Network Security: from 3.7.31, before 3.7.34 (fixed in 3.7.34); from 3.11.0, before 3.11.22 (fixed in 3.11.22); from 4.3.0, before 4.3.16 (fixed in 4.3.16); from 4.6.0, before 4.6.3 (fixed in 4.6.3)
• Zlib Zlib: up to and including 1.2.12

Published 2022-08-05. Last modified 2026-07-14.