Is CVE-2024-44146 being actively exploited?

CVE-2024-44146 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2024-44146?

CVE-2024-44146 has a CVSS 3.1 base score of 10.0 (CRITICAL).

CVE-2024-44146

CRITICAL · CVSS 10.0EPSS 0.7%EU EUVD

A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.

Key facts

CVSS score: 10.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS score: 0.7% (54th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2024-40899)
Published: September 17, 2024
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-40899 in the EU Vulnerability Database. Last updated in EUVD on April 2, 2026.

View on the EU Vulnerability Database

Affected products

apple / macos

Certified products that may be affected

15 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active
Strong Customer Authentication for Apple Pay on MacBookAir 2024 with M3 running macOS Sonoma 14.4 - Apple Inc. - Common Criteria 2024-11-INF-4471 - active
Strong Customer Authentication for Apple Pay on MacBookAir 2024with M3 running macOS Sonoma 14.4 - Apple Inc. - Common Criteria 2024-11-INF-4471 - active
Apple macOS 14 Sonoma: FileVault - Apple Inc. - Common Criteria CCEVS-VR-VID-11448-2025 - active
Strong Customer Authentication for Apple Pay on Mac mini with M2 Pro and Magic keyboard with Touch ID running macOS Sonoma 14.4(macOS Sonoma 14.4 (build 23E214)) (ANSSI-CC-2024/42) - Apple Inc. - Common Criteria ANSSI-CC-2024/42 - active

See all 15 in the Security Certifications Explorer.

References

http://seclists.org/fulldisclosure/2024/Sep/33
https://support.apple.com/en-us/121238(Release Notes, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain