{"id":"CVE-2024-44308","state":"PUBLISHED","title":"The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1","description":"The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.","publishedAt":"2024-11-19T23:43:50.135Z","updatedAt":"2026-04-02T18:23:18.275Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apple","products":["Apple Safari","Apple iOS and iPadOS","Apple macOS","Apple visionOS"],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"18.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"17.7.2","versionType":"custom"},{"version":"0","status":"affected","lessThan":"18.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","status":"affected","lessThan":"2.1.1","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/121752","https://support.apple.com/en-us/121753","https://support.apple.com/en-us/121754","https://support.apple.com/en-us/121755","https://support.apple.com/en-us/121756","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308","https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html","http://seclists.org/fulldisclosure/2024/Nov/16"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/44xxx/CVE-2024-44308.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-44308","state":"PUBLISHED","datePublished":"2024-11-19T23:43:50.135Z","dateUpdated":"2026-04-02T18:23:18.275Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2024-08-20T21:45:40.801Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems."}],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"18.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"17.7.2","versionType":"custom"},{"version":"0","status":"affected","lessThan":"18.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15.1.1","versionType":"custom"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","status":"affected","lessThan":"2.1.1","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/121752"},{"url":"https://support.apple.com/en-us/121753"},{"url":"https://support.apple.com/en-us/121754"},{"url":"https://support.apple.com/en-us/121755"},{"url":"https://support.apple.com/en-us/121756"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems."}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:23:18.275Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apple","product":"safari","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"18.1","versionType":"custom"}],"cpes":["cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:*"]},{"vendor":"apple","product":"macos","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"15.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*"]},{"vendor":"apple","product":"visionos","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:visionos:-:*:*:*:*:*:*:*"]},{"vendor":"apple","product":"iphone_os","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"17.7","versionType":"custom"},{"version":"18.0","status":"affected","lessThan":"18.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:iphone:*"]},{"vendor":"apple","product":"iphone_os","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"17.7","versionType":"custom"},{"version":"18.0","status":"affected","lessThan":"18.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:iphone:*"]},{"vendor":"apple","product":"ipad_os","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"17.7","versionType":"custom"},{"version":"18.0","status":"affected","lessThan":"18.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:ipad_os:-:*:*:*:*:*:*:*"]},{"vendor":"apple","product":"ipad_os","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"17.7","versionType":"custom"},{"version":"18.0","status":"affected","lessThan":"18.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:ipad_os:-:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-44308","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-11-23T04:55:46.745399Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2024-11-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T22:55:35.607Z"},"timeline":[{"time":"2024-11-21T00:00:00.000Z","lang":"en","value":"CVE-2024-44308 added to CISA KEV"}]},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html"},{"url":"http://seclists.org/fulldisclosure/2024/Nov/16"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:13:32.370Z"}}]}}}