# CVE-2022-22675: AppleAVD Overflow in AVC_RBSP::parseHRD

AppleAVD kernel H.264 HRD parser copies cpb_cnt_minus1 (up to 255) bitrate entries into a fixed 32-element buffer, overflowing the decoder struct; exploited as a zero-day.

- Payout: Real-world hack
- Severity: high
- Program: Apple iOS, MacOS
- Credited: Natalie Silvanovich
- Disclosed: 2022-03-31
- CVE: CVE-2022-22675
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-22675.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-22675
- Tags: domain:desktop domain:mobile impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:ios technique:source-review vuln:dos vuln:memory-corruption

**Target:** AppleAVD.kext H.264 HRD parser (AVC_RBSP::parseHRD)
**Root cause:** parseHRD loops over cpb_cnt_minus1+1 bitrate entries read from the H.264 stream and writes them into a fixed 32-element buffer; cpb_cnt_minus1 can be up to 255, overflowing into adjacent decoder struct members.
**Steps:**
1. Craft an H.264 stream whose HRD parameters set `cpb_cnt_minus1` to a value >31 (max 255).
2. Feed the stream to AppleAVD (e.g. via media thumbnailing on iOS 15.4/macOS 12.3).
3. parseHRD copies cpb_cnt_minus1+1 bitrate values into the 32-element buffer, overflowing adjacent struct members.
4. Patched build logs `ERROR: hrd.cpb_cnt_minus1` and aborts decoding when value >=32.
**How found:** RCA authors note the overflow stays within the decoder struct and resisted days of fuzzing from a partial PoC template, so the original discovery was likely a manual binary audit of AppleAVD rather than fuzzing.
**Exploitation:** Zero-day exploited in the wild; exact exploit sample not analyzed. On iOS 15.4/macOS 12.3 the parser is reachable remotely via iMessage image thumbnailing, though advisories rate impact as local privilege escalation. Overflow is confined to other members of the decoder struct, not adjacent heap allocations, so a working trigger required subtle conditions not reproduced by the RCA team.
**Insight:** When a length field bounds a copy into a fixed-size array, check the field's declared max against the array size — here cpb_cnt_minus1's spec max of 255 vs a 32-element buffer. Also note kernel media parsers reachable via thumbnail generation widen remote attack surface.