CVE-2024-44207

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-44207 is a vulnerability in the Messages application on Apple's mobile platforms, where an incoming audio message could capture several seconds of audio from the device microphone before the microphone indicator activates. The flaw was caused by inadequate validation checks and is fixed in iOS 18.0.1 and iPadOS 18.0.1. It carries a CVSS 4.3 score reflecting network attack vector, low complexity, and limited confidentiality impact.

An unauthenticated remote attacker can trigger the issue by sending a crafted audio message that the recipient opens or plays, resulting in brief unauthorized audio capture without immediate user notification. The attack requires user interaction and does not allow further system compromise or data modification.

Apple's security update for iOS 18.0.1 and iPadOS 18.0.1 resolves the problem through improved checks, as described in the vendor advisory at support.apple.com/en-us/121373. The corresponding disclosure appears on seclists.org.

The associated EPSS score remains low and essentially flat, indicating no significant post-disclosure exploitation interest.