CVE-2024-44308 KEV
8.8
HIGH · CVSS 3.1 · EPSS 10.1% (pctl 95)
Patch first
On CISA KEV — known exploited in the wild, due 2024-12-12.
Description
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Scoring
| CVSS | 8.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 10.08% — more likely to be exploited than 95% of all CVEs |
| On CISA KEV | yes — remediate by 2024-12-12 |
| Public exploit | none known |
| Published | 2024-11-20 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Apple Multiple Products Code Execution Vulnerability |
|---|---|
| Added | 2024-11-21 |
| Due | 2024-12-12 |
| Vendor / product | Apple / Multiple Products |
| Ransomware use | none reported |
Affected (6)
| Vendor | Product |
|---|---|
| apple | ipados |
| apple | iphone os |
| apple | macos |
| apple | safari |
| apple | visionos |
| debian | debian linux |
References
- https://support.apple.com/en-us/121752
- https://support.apple.com/en-us/121753
- https://support.apple.com/en-us/121754
- https://support.apple.com/en-us/121755
- https://support.apple.com/en-us/121756
- http://seclists.org/fulldisclosure/2024/Nov/16
- https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308
→ the Explorer · watch your stack · NVD