Log in Start free

Actively exploited · Published Mar 5, 2024 · Assigned by apple

CVE-2024-23296

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on March 6, 2024). The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildYesCISA KEV since Mar 6, 2024
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Mar 27, 2024.

Official description

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Affected products (as reported)

VendorProductVersions
Apple iOS and iPadOS 0 – before 16.7.80 – before 17.4
Apple macOS 0 – before 12.7.60 – before 13.6.70 – before 14.4
Apple tvOS 0 – before 17.4
Apple visionOS 0 – before 1.1
Apple watchOS 0 – before 10.4

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References