CVE-2024-44199
Published: 21 March 2025
Summary
CVE-2024-44199 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE's root cause of out-of-bounds read through improved input validation to prevent kernel memory disclosure and system crashes.
Implements memory safeguards such as bounds checking and isolation to block unauthorized kernel memory access by malicious apps.
Ensures timely remediation and patching of the specific flaw in macOS Sonoma prior to 14.6 to eliminate exploitability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in kernel allows local low-priv app to disclose kernel memory (facilitating privilege escalation via T1068) or trigger system crashes (enabling DoS via application/system exploitation in T1499.004).
NVD Description
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause unexpected system termination or read kernel memory.
Deeper analysisAI
CVE-2024-44199 is an out-of-bounds read vulnerability, classified under CWE-125, affecting macOS Sonoma versions prior to 14.6. Apple addressed the issue through improved input validation. The flaw enables an app to potentially cause unexpected system termination or read kernel memory.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Per the CVSS v3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), successful exploitation yields high confidentiality impact via kernel memory disclosure and high availability impact through system crashes, with no integrity impact.
Apple's security advisory confirms the issue is fixed in macOS Sonoma 14.6. Practitioners should apply this update promptly, as detailed at https://support.apple.com/en-us/120911.
Details
- CWE(s)