CVE-2024-40784: 
macOS vulnerability analysis and mitigation

CVE-2024-40784 is an integer overflow vulnerability discovered in Apple's ImageIO component that affects multiple Apple operating systems including iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. The vulnerability was disclosed and patched on July 29, 2024. The issue was identified by Junsung Lee working with Trend Micro Zero Day Initiative and Gandalf4a (Apple Advisory).

The vulnerability is classified as an integer overflow issue in the ImageIO component that was addressed with improved input validation. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) by NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. CISA-ADP assessed it with a higher CVSS score of 7.8 (High) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, processing a maliciously crafted file may lead to unexpected app termination. The vulnerability affects multiple Apple operating systems including iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, and macOS Sonoma 14.6 (Apple Advisory).

The vulnerability requires local access and user interaction to exploit. While technical details about exploitation are not publicly available, the vulnerability has been assigned CWE-190 (Integer Overflow or Wraparound) classification (NVD).

Apple has released security updates to address this vulnerability across their affected operating systems. Users should update to iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, or macOS Sonoma 14.6 depending on their device (Apple Advisory).