CVE-2024-27856 Details
Description
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
A vulnerability in WebKit, the engine powering Safari and other applications, allows for processing maliciously crafted files, which can lead to unexpected app termination or arbitrary code execution. This issue affects multiple Apple platforms, including macOS Sonoma 14.5, iOS 17.5, iPadOS 17.5, watchOS 10.5, tvOS 17.5, and visionOS 1.2. The vulnerability arises from an out-of-bounds write issue that was addressed with improved input validation and memory handling.
Users can update to the latest versions of macOS, iOS, iPadOS, watchOS, tvOS, or visionOS to address this vulnerability. Instructions for updating can be found on the Apple Support website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.apple.com/en-us/120896 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120898 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120901 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120902 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120903 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120905 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/120906 | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple safari | < 17.5 |
CPE
Remediation
| |
| apple ipados | < 16.7.8 >= 17.0, < 17.5 |
CPE
Remediation
| |
| apple iphone os | < 16.7.8 >= 17.0, < 17.5 |
CPE
Remediation
| |
| apple macos | < 14.5 |
CPE
Remediation
| |
| apple tvos | < 17.5 |
CPE
Remediation
| |
| apple visionos | < 1.2 |
CPE
Remediation
| |
| apple watchos | < 10.5 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | CVE Modified | [email protected] |
| Mar 14, 2025 | Initial Analysis | [email protected] |
| Jan 16, 2025 | CVE Modified | CISA-ADP |
| Jan 15, 2025 | New CVE Received | [email protected] |