CVE-2024-44148
CRITICAL · CVSS 10.0EPSS 0.7%EU EUVD
This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
Key facts
- CVSS score
- 10.0 (v3.1)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- EPSS score
- 0.7% (51th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2024-40901)
- Published
- September 17, 2024
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2024-40901 in the EU Vulnerability Database. Last updated in EUVD on April 2, 2026.
View on the EU Vulnerability DatabaseAffected products
- apple / macos
Certified products that may be affected
15 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active
- Strong Customer Authentication for Apple Pay on MacBookAir 2024 with M3 running macOS Sonoma 14.4 - Apple Inc. - Common Criteria 2024-11-INF-4471 - active
- Strong Customer Authentication for Apple Pay on MacBookAir 2024with M3 running macOS Sonoma 14.4 - Apple Inc. - Common Criteria 2024-11-INF-4471 - active
- Apple macOS 14 Sonoma: FileVault - Apple Inc. - Common Criteria CCEVS-VR-VID-11448-2025 - active
- Strong Customer Authentication for Apple Pay on Mac mini with M2 Pro and Magic keyboard with Touch ID running macOS Sonoma 14.4(macOS Sonoma 14.4 (build 23E214)) (ANSSI-CC-2024/42) - Apple Inc. - Common Criteria ANSSI-CC-2024/42 - active
See all 15 in the Security Certifications Explorer.
References
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain