Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23222 is a high-severity Type Confusion (CWE-843) vulnerability in Apple Ipados. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A type confusion vulnerability addressed through improved input validation affects WebKit in multiple Apple platforms. Impacted software includes Safari 17.3 along with iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.5, iPadOS 16.7.5, iOS 17.3, iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, and visionOS 1.0.2. The flaw permits arbitrary code execution when processing maliciously crafted web content and carries a CVSS 3.1 base score of 8.8.
An unauthenticated remote attacker can exploit the issue by convincing a user to visit a specially crafted website, achieving code execution in the context of the browser process without requiring user privileges beyond normal web browsing. The vulnerability is linked to the Coruna exploit and was initially shipped for current iOS devices in version 17.3 on 22 January 2024, with the listed updates extending the same fix to devices that cannot receive the newest major releases.
Apple security advisories recommend installing the listed updates, which are available via the standard software update mechanisms on each platform. The current EPSS score stands at 0.0062.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20741
Vulnerability Data
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4,…
more
tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.
- CWE(s)
- KEV Date Added
- 23 January 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V15.3.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and type-aware analysis) directly finds type-confusion flaws before deployment.
Engineering principles can require use of type-safe languages, static typing, and runtime type checks that structurally avoid allocating one type and accessing another.
Memory-protection controls limit the blast radius when a type-confusion access occurs but do not stop the flaw itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-confusion flaws via safe typing, static analysis, and code review while the control itself addresses many additional weaknesses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.