CVE-2024-40803: 
macOS vulnerability analysis and mitigation

A type confusion vulnerability (CVE-2024-40803) was discovered in macOS affecting the Keychain Access component. The vulnerability was fixed in macOS Sonoma 14.6, macOS Monterey 12.7.6, and macOS Ventura 13.6.8, released on July 29, 2024. The issue was identified by Patrick Wardle of DoubleYou & the Objective-See Foundation (Apple Support, NVD).

The vulnerability is classified as a type confusion issue in the Keychain Access component that was addressed with improved checks. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is tracked under CWE-843 (Access of Resource Using Incompatible Type) (NVD).

When exploited, this vulnerability may allow an attacker to cause unexpected app termination in the Keychain Access component (Apple Support, Apple Support, Apple Support).

The vulnerability requires no special privileges or user interaction to exploit, as indicated by the CVSS metrics (PR:N/UI:N). The attack can be launched remotely (AV:N) with low attack complexity (AC:L) (NVD).

Apple has addressed this vulnerability by implementing improved checks in the affected versions. Users should update to macOS Sonoma 14.6, macOS Monterey 12.7.6, or macOS Ventura 13.6.8 depending on their operating system version (Apple Support, Apple Support, Apple Support).