CVE-2024-44281: 
macOS vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2024-44281) was discovered in Apple macOS's ICC profile parsing functionality. The vulnerability was reported by Hossein Lotfi of Trend Micro Zero Day Initiative and was fixed in macOS Ventura 13.7.1 and macOS Sonoma 14.7.1, released on October 28, 2024. The vulnerability affects the parsing of files which could lead to disclosure of user information (Apple Support, ZDI).

The vulnerability stems from improper validation of user-supplied data during ICC profile parsing, which can result in a read past the end of an allocated buffer. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N by NIST NVD, indicating local access is required with user interaction (NVD).

When exploited, this vulnerability can lead to the disclosure of sensitive user information through an out-of-bounds read operation. The vulnerability requires user interaction, such as opening a maliciously crafted file, to be exploited (ZDI).

Apple has addressed this vulnerability by implementing improved input validation in macOS Ventura 13.7.1 and macOS Sonoma 14.7.1. Users are advised to update to these versions to protect against potential exploitation (Apple Support, Apple Support).