CVE-2024-54498
Published: 12 December 2024
Summary
CVE-2024-54498 is a high-severity an unspecified weakness vulnerability in Apple Macos. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A path handling issue was addressed with improved validation in macOS Sequoia 15.2, macOS Sonoma 14.7.2, and macOS Ventura 13.7.2. The flaw allows an app to escape its sandbox, carrying a CVSS 3.1 score of 8.8 that reflects local attack vector, low complexity, and changed scope with high impact on confidentiality, integrity, and availability.
An attacker who can run code as a local user can exploit the weakness to break out of the app sandbox and access resources outside its intended boundaries. The vulnerability requires no user interaction and affects any application that relies on the flawed path-handling logic present in the listed macOS releases.
Apple security updates for the three affected macOS versions resolve the issue through improved input validation. The associated EPSS score remains flat at 0.0805 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52597
Vulnerability details
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.