Apple Multiple Products Code Execution Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2024-44308 · Published 20/11/2024 · updated 17/06/2026

Apple Multiple Products Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 21/11/2024. Patch affected systems as an emergency.

In short

CVE-2024-44308 is a HIGH (CVSS 8.8) vulnerability affecting safari (apple).
Exploited in the wild: CISA added it to the KEV catalog on 21/11/2024.
Chance of exploitation in the next 30 days (EPSS): 9.9%, higher than 95.6% of all vulnerabilities.
Fix: update to 18.1.1 or later.

Package	Affected versions	Patched versions
safari apple	`< 18.1.1`	`18.1.1`

Description

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

References

support.apple.com/en-us/121752 · Vendor Advisory
support.apple.com/en-us/121753 · Vendor Advisory
support.apple.com/en-us/121754 · Vendor Advisory
support.apple.com/en-us/121755 · Vendor Advisory
support.apple.com/en-us/121756 · Vendor Advisory
seclists.org/fulldisclosure/2024/Nov/16 · Mailing List
lists.debian.org/debian-lts-announce/2024/12/msg00003.html · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2024-44308

More vulnerabilities in safari

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

safari

apple

< 18.1.1

18.1.1

Description

More vulnerabilities in safari

See all →