CVE-2024-44308KEV · OVERDUE

Apple Multiple Products Code Execution Vulnerability

High · published November 19, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.7th percentile for exploit probability.

681
days past CISA
deadline
CVSS v3.1
8.8
EPSS
10%
Percentile
95.7
In the wild
Confirmed
What it is

🚨 Malicious web content can lead to arbitrary code execution on your device, and it's already been exploited! 🔥 Think of it like a restaurant that serves food without checking the ingredients—someone could slip in a dangerous recipe, and the guests (your device) could get seriously sick. 🍽️ If an attacker successfully exploits this vulnerability, they could take control of your system, execute unauthorized commands, or steal sensitive information. This isn't just a minor inconvenience; it could lead to significant data breaches or even compromise your entire system.

Put simply

Think of it like a restaurant that serves food without checking the ingredients—someone could slip in a dangerous recipe, and the guests (your device) could get seriously sick. 🍽️ CVE-2024-44308 is a vulnerability in Apple’s Safari and other platforms which allows for arbitrary code execution due to insufficient checks on crafted web content. This opens the door for attackers to execute malicious code remotely, particularly on Intel-based Macs.

What to do

If an attacker successfully exploits this vulnerability, they could take control of your system, execute unauthorized commands, or steal sensitive information. This isn't just a minor inconvenience; it could lead to significant data breaches or even compromise your entire system. To protect yourself, update immediately to Safari 18.1.1, iOS 17.7.2, iPadOS 17.7.2, macOS Sequoia 15.1.1, or the latest versions of iOS and iPadOS. Ensure all your Apple devices are running the latest software for maximum security. 🛡️ You've got this! Follow these steps and you'll be one step closer to securing your device from these sneaky threats! 😄

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10157 · 95.7th percentile
Published
2024-11-19T23:43Z
KEV added
2024-11-21 · due 2024-12-12
EPSS history
Timeline
  • 21 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 12
    kev
  • 19 NOV 23:43Z
    The issue was addressed with improved checks
    cvelistv5