Cyber Posture

CVE-2024-40849

High

Published: 02 April 2026

Published
02 April 2026
Modified
03 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0008 23.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-40849 is a high-severity Race Condition (CWE-362) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-39 (Process Isolation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the specific race condition flaw in macOS sandbox enforcement by applying the vendor patch released in Sequoia 15.1.

prevent

Maintains separate execution domains for sandboxed apps to prevent breakout and unauthorized access to sensitive resources outside confinement.

prevent

Implements a tamper-resistant reference monitor to enforce sandbox access policies, mitigating bypasses via race conditions in validation.

NVD Description

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox.

Deeper analysisAI

CVE-2024-40849 is a race condition vulnerability (CWE-362) that was addressed through additional validation. It affects macOS systems prior to Sequoia 15.1, enabling a malicious app to potentially break out of its sandbox confinement. The issue received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to network accessibility and significant confidentiality impact.

A remote attacker with no privileges or user interaction required can exploit this vulnerability over the network with low complexity. Successful exploitation allows the app to escape its sandbox, potentially granting access to sensitive data or system resources outside the intended isolation boundaries.

Apple's security advisory confirms the fix in macOS Sequoia 15.1, recommending users update to this version to mitigate the issue. Additional details are available at https://support.apple.com/en-us/121564.

Details

CWE(s)

Affected Products

apple
macos
≤ 15.1

CVEs Like This One

CVE-2026-28817Same product: Apple Macos
CVE-2025-43244Same product: Apple Macos
CVE-2025-43275Same product: Apple Macos
CVE-2025-31188Same product: Apple Macos
CVE-2026-28891Same product: Apple Macos
CVE-2025-30444Same product: Apple Macos
CVE-2025-30452Same product: Apple Macos
CVE-2025-43219Same product: Apple Macos
CVE-2025-43189Same product: Apple Macos
CVE-2025-24267Same product: Apple Macos

References