CVE-2024-23225
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
Key facts
- CVSS score
- 7.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-787
- EPSS score
- 1.5% (73th percentile)
- In CISA KEV
- Yes, added March 6, 2024
- In EU EUVD
- Yes (EUVD-2024-20744)
- Published
- March 5, 2024
- NVD last modified
- June 17, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Apple Multiple Products Memory Corruption Vulnerability
Added to the KEV catalog on March 6, 2024; federal remediation due March 27, 2024.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2024-20744 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on April 2, 2026.
View on the EU Vulnerability DatabaseAffected products
- apple / ipados
- apple / iphone os
- apple / macos
- apple / tvos
- apple / visionos
- apple / watchos
Certified products that may be affected
22 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active
- Apple iPadOS 17: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11447-2025 - active
- Apple macOS 14 Sonoma: FileVault - Apple Inc. - Common Criteria CCEVS-VR-VID-11448-2025 - active
- Strong Customer Authentication for Apple Pay, on MacBook Air 2022 with M2 running macOS Ventura 13.3.1 - Apple Inc. - Common Criteria 2023-9-INF-4307 - active
- Strong Customer Authentication for Apple Pay on Apple Watch with S8 running watchOS 9.4(watchOS 9.4 (build 20T253)) ( ANSSI-CC-2023/60) - Apple Inc. - Common Criteria ANSSI-CC-2023/60 - active
See all 22 in the Security Certifications Explorer.
References
- http://seclists.org/fulldisclosure/2024/Mar/18(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/21(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/22(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/23(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/24(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/25(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/26(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/120880(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120881(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120882(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120883(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120884(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120886(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120893(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120895(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT214081(Vendor Advisory)
- https://support.apple.com/en-us/HT214082(Vendor Advisory)
- https://support.apple.com/kb/HT214082(Vendor Advisory)
- https://support.apple.com/kb/HT214083(Vendor Advisory)
- https://support.apple.com/kb/HT214084(Vendor Advisory)
- https://support.apple.com/kb/HT214085(Vendor Advisory)
- https://support.apple.com/kb/HT214086(Vendor Advisory)
- https://support.apple.com/kb/HT214087(Vendor Advisory)
- https://support.apple.com/kb/HT214088(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23225(US Government Resource)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain