Actively exploited · Published Apr 3, 2019 · Assigned by apple
CVE-2018-4344
High 7.8 Exploited
In plain English
A high-severity memory corruption in iOS, macOS, tvOS, watchOS. Attackers are actively exploiting it in the wild (listed by CISA on June 27, 2022). The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildYesCISA KEV since Jun 27, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 18, 2022.
Official description
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | iOS, macOS, tvOS, watchOS | Versions prior to: iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/kb/HT209107 x_refsource_MISC
- https://support.apple.com/kb/HT209106 x_refsource_MISC
- https://support.apple.com/kb/HT209139 x_refsource_MISC
- https://support.apple.com/kb/HT209108 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4344 government-resource