CVE-2024-40849
Published: 02 April 2026
Summary
CVE-2024-40849 is a high-severity Race Condition (CWE-362) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-39 (Process Isolation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific race condition flaw in macOS sandbox enforcement by applying the vendor patch released in Sequoia 15.1.
Maintains separate execution domains for sandboxed apps to prevent breakout and unauthorized access to sensitive resources outside confinement.
Implements a tamper-resistant reference monitor to enforce sandbox access policies, mitigating bypasses via race conditions in validation.
NVD Description
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox.
Deeper analysisAI
CVE-2024-40849 is a race condition vulnerability (CWE-362) that was addressed through additional validation. It affects macOS systems prior to Sequoia 15.1, enabling a malicious app to potentially break out of its sandbox confinement. The issue received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to network accessibility and significant confidentiality impact.
A remote attacker with no privileges or user interaction required can exploit this vulnerability over the network with low complexity. Successful exploitation allows the app to escape its sandbox, potentially granting access to sensitive data or system resources outside the intended isolation boundaries.
Apple's security advisory confirms the fix in macOS Sequoia 15.1, recommending users update to this version to mitigate the issue. Additional details are available at https://support.apple.com/en-us/121564.
Details
- CWE(s)