CVE-2024-23286: 
macOS vulnerability analysis and mitigation

CVE-2024-23286 is a buffer overflow vulnerability discovered in Apple's ImageIO component that affects multiple Apple operating systems. The vulnerability was disclosed on March 7, 2024, and has been fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, and tvOS 17.4 (Apple Security).

The vulnerability is a buffer overflow issue in the ImageIO component that occurs during image processing. The flaw was addressed by implementing improved memory handling mechanisms. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, CISA-ADP assessed it with a CVSS score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could lead to arbitrary code execution when processing maliciously crafted images. The successful exploitation could allow an attacker to execute arbitrary code on the affected system (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically requiring the target to process a maliciously crafted image. The vulnerability was discovered by multiple security researchers including Junsung Lee working with Trend Micro Zero Day Initiative, Amir Bazine and Karsten König of CrowdStrike Counter Adversary Operations, Dohyun Lee (@l33d0hyun), and Lyutoon and Mr.R (Apple Security).

Apple has released security updates to address this vulnerability across their affected operating systems. Users are advised to update to the following versions: macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, or tvOS 17.4 (Apple Security).