Cyber Resilience

CVE-2024-44219

High

Published: 02 April 2026

Published
02 April 2026
Modified
03 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0010 26.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-44219 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-44219 is a permissions issue, classified under CWE-284, that was addressed through additional restrictions in macOS. The vulnerability affects macOS versions prior to Sequoia 15.1, where a malicious application with root privileges could access private information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and low attack complexity.

Exploitation requires an attacker to deploy a malicious application that has obtained root privileges on the target system. Once running with elevated privileges, the application can access private information that should otherwise be restricted, potentially leading to unauthorized data exposure.

Apple's advisory at https://support.apple.com/en-us/121564 confirms the issue is fixed in macOS Sequoia 15.1, recommending users update to this version for mitigation. No additional workarounds are specified in the provided details.

EU & UK References

Vulnerability details

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Vulnerability enables root-privileged local app to bypass restrictions and access private data on the system, directly facilitating unauthorized local data collection.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-40858Same product: Apple Macos
CVE-2026-28837Same product: Apple Macos
CVE-2025-24229Same product: Apple Macos
CVE-2025-43198Same product: Apple Macos
CVE-2025-30460Same product: Apple Macos
CVE-2025-24241Same product: Apple Macos
CVE-2025-30424Same product: Apple Macos
CVE-2025-24204Same product: Apple Macos
CVE-2024-44303Same product: Apple Macos
CVE-2025-24263Same product: Apple Macos

Affected Assets

apple
macos
≤ 15.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the specific permissions flaw by requiring timely identification, reporting, and application of patches such as macOS Sequoia 15.1.

prevent

Enforces approved authorizations and restrictions on access to private information, directly addressing the permissions issue exploited by root-privileged malicious applications.

prevent

Applies least privilege to limit root-privileged applications to only necessary accesses, mitigating unauthorized exposure of private information.

References