Arbitrary Code Execution Vulnerability in Apple Products
CVE-2024-27859

8.8HIGH

Key Information:

Vendor
Apple
Status
Watch OS
TV OS
Visionos
Mac OS
Vendor
CVE Published:
10 February 2025

Summary

An arbitrary code execution vulnerability has been identified in multiple Apple products due to inadequate memory handling. Successful exploitation of this vulnerability occurs when processing specially crafted web content, potentially allowing an attacker to execute arbitrary code on the affected device. Apple has addressed this issue in the latest updates for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS, enhancing memory management to mitigate the risk.

Affected Version(s)

iOS and iPadOS < 17.4

macOS < 14.4

tvOS < 17.4

References

https://support.apple.com/en-us/120881
https://support.apple.com/en-us/120882
https://support.apple.com/en-us/120883

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.