CVE-2024-40775: 
macOS vulnerability analysis and mitigation

A downgrade issue in AppleMobileFileIntegrity was discovered and addressed in macOS Sonoma 14.6, macOS Monterey 12.7.6, and macOS Ventura 13.6.8, released on July 29, 2024. The vulnerability (CVE-2024-40775) was discovered by Mickey Jin (@patch1t) and could allow an app to leak sensitive user information (Apple Support, NVD).

The vulnerability was identified as a downgrade issue in the AppleMobileFileIntegrity component that was addressed with additional code-signing restrictions. The issue has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access is required with low attack complexity (NVD).

If exploited, this vulnerability could allow a malicious application to leak sensitive user information, potentially compromising user privacy. The vulnerability affects multiple versions of macOS including Sonoma, Monterey, and Ventura (Apple Support).

The vulnerability requires local access with low attack complexity to exploit. No public exploits have been reported in the wild at the time of disclosure (NVD).

Apple has released security updates to address this vulnerability in macOS Sonoma 14.6, macOS Monterey 12.7.6, and macOS Ventura 13.6.8. Users are advised to update their systems to the latest versions available through the Mac App Store or Apple's Software Downloads website (Apple Support).