Log in Start free

Actively exploited · Published Sep 18, 2014 · Assigned by apple

CVE-2014-4404

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in OS X from Apple. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2022). The chance it is exploited in the next 30 days is estimated at 48.9% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)48.9%top 1.1% of all CVEs
Exploited in the wildYesCISA KEV since Feb 10, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Aug 10, 2022.

Official description

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References