CVE-2024-44308

Apple Multiple Products Code Execution

8.8 HIGHActively exploited (CISA KEV)EPSS 10.2%

Published19 Nov 2024
Added to CISA KEV21 Nov 2024
Remediation due12 Dec 2024

Description

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Apple Safari< 18.1.1

Apple iPadOS≥ 18.0 < 18.1.1 · < 17.7.2

Apple iPhone OS≥ 18.0 < 18.1.1 · < 17.7.2

Apple macOS≥ 15.0 < 15.1.1

Apple Visionos< 2.1.1

Debian Linux11.0

Remediation

Fixed in

Apple Safari≥ 18.1.1

Apple iPadOS≥ 18.1.1

Apple iPhone OS≥ 18.1.1

Apple macOS≥ 15.1.1

Apple Visionos≥ 2.1.1

Patch & vendor advisories

References

http://seclists.org/fulldisclosure/2024/Nov/16Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00003.htmlMailing List
https://support.apple.com/en-us/121752Vendor Advisory
https://support.apple.com/en-us/121753Vendor Advisory
https://support.apple.com/en-us/121754Vendor Advisory
https://support.apple.com/en-us/121755Vendor Advisory
https://support.apple.com/en-us/121756Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308US Government Resource

Frequently asked

Is CVE-2024-44308 being actively exploited?

Yes. CVE-2024-44308 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 21 Nov 2024.

How severe is CVE-2024-44308?

CVE-2024-44308 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 10.2% probability of exploitation.

Which products are affected by CVE-2024-44308?

Affected products include Apple Safari, Apple iPadOS, Apple iPhone OS, Apple macOS, Apple Visionos, and 1 more.

How do I fix CVE-2024-44308?

Upgrade affected software to a fixed version, for example Apple Safari 18.1.1, Apple iPadOS 18.1.1, Apple iPhone OS 18.1.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-44308 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.