CVE-2024-54502

Deeper analysis

CVE-2024-54502 is an out-of-bounds read vulnerability (CWE-125) that affects WebKit-based web content processing in Apple platforms. It was addressed through improved input validation checks and is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, and watchOS 11.2. The flaw carries a CVSS 3.1 score of 6.5 and can be triggered by maliciously crafted web content, resulting in an unexpected process crash with high availability impact but no confidentiality or integrity loss.

An unauthenticated remote attacker can exploit the issue by serving specially crafted web content that a victim visits in a vulnerable browser or app. Successful exploitation requires user interaction such as loading the page, after which the target process terminates, producing a denial-of-service condition without further code execution or data access.

Apple security advisories for the listed updates state that the issue is resolved by the improved checks shipped in those releases; organizations should apply the patches through standard software update mechanisms on affected devices. The associated EPSS score remains low and essentially flat at approximately 0.078, indicating no significant post-disclosure exploitation interest.