CVE-2024-44308: Apple Multiple Products Code Execution Vulnerability
Vulnerability summary
CVE-2024-44308 is a high (CVSS 8.8) vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 21-11-2024. EPSS estimates a 10.16% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 19-11-2024PublishedVulnerability first disclosed.
- 21-11-2024Added to CISA KEVApple Multiple Products Code Execution Vulnerability
- 12-12-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 02-04-2026Last modifiedVulnerability information updated.
Description
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
10.16%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.16% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 21-11-2024
- Federal due date
- 12-12-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2024-44308
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Apple6 products
- ios and ipados< 17.7.2 | < 18.1.1
- ipados< 17.7.2 | ≥ 18.0, < 18.1.1
- iphone_os< 17.7.2 | ≥ 18.0, < 18.1.1
- macos< 15.1.1 | ≥ 15.0, < 15.1.1
- safari< 18.1.1
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.46.4-0ubuntu0.22.04.1 | < 2.46.4-0ubuntu0.24.04.1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian3 products
- webkit2gtk< 2.46.4-1~deb12u1 | < 2.46.4-1
- wpewebkitAll versions (No fix recorded) | < 2.46.4-1
- debian_linuxEOL11.0
3 vendors · 14 products
References
14 links- support.apple.com/en-us/121752Vendor Advisory
- support.apple.com/en-us/121753Vendor Advisory
- support.apple.com/en-us/121754Vendor Advisory
- support.apple.com/en-us/121755Vendor Advisory
- support.apple.com/en-us/121756Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308Government ResourceUS Government Resource
