Security features bypass in macOS - CVE-2024-44278

Vulnerability identifier: #VU99399

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-44278

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to improper checks in Siri. An local application can access sensitive user data in system logs.

macOS
visionOS
watchOS
iPadOS
Apple iOS

Install updates from vendor's website.

macOS - addressed in versions 13.7.1 22H221, 14.7.1 23H222, 15.1 24B83
visionOS - update to 2.1
watchOS - update to 11.1
iPadOS - addressed in versions 17.7.1 21H216, 18.1 22B83
Apple iOS - addressed in versions 17.7.1 21H216, 18.1 22B83

• https://support.apple.com/en-us/121568

• Multiple vulnerabilities in macOS Ventura
• Multiple vulnerabilities in macOS Sonoma
• Multiple vulnerabilities in macOS Sequoia
• Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
• Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple visionOS