CVE-2024-44308

Deeper analysis

CVE-2024-44308 is a vulnerability in Apple's web content processing components that was addressed through improved input validation checks. It affects Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1. The flaw permits arbitrary code execution when maliciously crafted web content is processed, and carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges.

An unauthenticated remote attacker can exploit the issue by serving malicious web content that a victim visits or renders, resulting in full arbitrary code execution on the target system with impacts to confidentiality, integrity, and availability. User interaction is required in the form of processing the crafted content.

Apple security advisories for the listed products confirm that the fixes are delivered via the updated releases and note that the issue may have been actively exploited in the wild against Intel-based Mac systems. The EPSS score rose from a low starting value to a recorded peak of 0.0186, indicating emerging post-disclosure exploitation interest that warrants renewed attention.