Main Vulnerability Database Vulnerabilities #VU87275

Spoofing attack in visionOS - CVE-2024-23262

Published: March 7, 2024

Vulnerability identifier: #VU87275

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-23262

CWE-ID: CWE-451

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local application to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data within the Accessibility feature. A local application can spoof system notifications and UI.

Affected software

visionOS
iPadOS
Apple iOS

How to mitigate CVE-2024-23262

Install updates from vendor's website.

visionOS - update to 1.1
iPadOS - addressed in versions 16.7.6, 17.4 21E217
Apple iOS - addressed in versions 16.7.6 20H320, 17.4 21E217

External References

https://support.apple.com/en-us/HT214087

Related Security Bulletins