CVE-2024-27886: 
macOS vulnerability analysis and mitigation

CVE-2024-27886 is a security vulnerability affecting macOS Sonoma versions prior to 14.4. The vulnerability was discovered by Stephan Casas and an anonymous researcher, and was disclosed on July 29, 2024. This vulnerability exists in the AppKit component of macOS Sonoma and allows an unprivileged application to log keystrokes in other applications, including those using secure input mode (Apple Support).

The vulnerability is classified as a logic issue in the AppKit component of macOS Sonoma. According to the National Vulnerability Database, it has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The CISA-ADP assessment rates it higher at 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability allows an unprivileged application to capture keystrokes from other applications on the system, even when those applications are using secure input mode. This capability could potentially lead to the theft of sensitive information such as passwords and personal data entered through the keyboard (CIS Advisory).

There are currently no reports of this vulnerability being actively exploited in the wild. The vulnerability requires local access to the system and user interaction to be exploited (CIS Advisory).

Apple has addressed this vulnerability by improving restrictions in the AppKit component. The fix is included in macOS Sonoma 14.4. Users are advised to update their systems to this version or later to protect against this vulnerability (Apple Support).