NetSight
IP …
high7.8Known exploited

CVE-2024-23296

Apple Multiple Products Memory Corruption Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-03-06. Federal due date: 2024-03-27.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Affected products

VendorProductAffected versions
AppleIpados
before 16.7.8
from 17.0 before 17.4
AppleIphone Os
before 16.7.8
from 17.0 before 17.4
AppleMacos
from 12.0 before 12.7.6
from 13.0 before 13.6.7
from 14.0 before 14.4
AppleTvos
before 17.4
AppleVisionos
before 1.1
AppleWatchos
before 10.4

Weakness classification

CWE-787

References