Apple has released an emergency security patch that addresses a critical zero-day vulnerability which may have been exploited in-the-wild, affecting macOS, watchOS, and tvOS. The flaw, tracked as CVE-2022-22675, is described as an out-of-bounds write vulnerability which could allow an attacker to execute arbitrary code with kernel level privileges following the compromise of mobile applications on the vulnerable device. Specifically, the exploit is due to a flaw in the Apple Audio Video Decode (AppleAVD) kernel extension (kext), that decodes multiple A/V encoding mechanisms like HEVC, H.265, and VP9. Apple stated in their security advisory that the vulnerability “may have been actively exploited,” but did not provide additional details. Analysts assess this is to allow as many Apple users as possible to update their vulnerable devices before the exploit becomes publicly known. According to Apple, the evidence suggests that the active exploits are very targeted, but they still state all users should consider updating their devices as soon as possible. The vulnerable operating system versions, as well as details about the patch, are available in the Apple advisory linked below.