CVE-2024-40780: Apple iPhone OS Buffer Overflow Vulnerability

CVE-2024-40780 Overview

CVE-2024-40780 is an out-of-bounds read vulnerability [CWE-125] affecting Apple's WebKit browser engine across multiple operating systems and Safari. Processing maliciously crafted web content may trigger an unexpected process crash. Apple addressed the issue with improved bounds checking in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6.

Critical Impact
An attacker who convinces a user to load crafted web content can crash the rendering process, causing denial of service on Apple devices running vulnerable WebKit builds.

Affected Products

Apple iOS and iPadOS (prior to 16.7.9 and 17.6)
Apple macOS Sonoma (prior to 14.6), tvOS (prior to 17.6), visionOS (prior to 1.3), watchOS (prior to 10.6)
Apple Safari (prior to 17.6)

Discovery Timeline

2024-07-29 - CVE-2024-40780 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40780

Vulnerability Analysis

The flaw is an out-of-bounds read within WebKit, the browser engine that renders web content in Safari and other Apple application contexts. When WebKit processes crafted HTML, JavaScript, or related web assets, insufficient bounds checking allows the engine to read memory outside of an intended buffer. The result is an unexpected process crash affecting the content rendering process.

Because the vulnerability is confined to a read primitive without memory corruption, exploitation does not yield code execution according to the vendor's advisory. The impact is availability loss on the local device, consistent with a user-interaction-required attack path.

Root Cause

The root cause is missing or insufficient bounds validation on an index or pointer used to access a buffer within WebKit's content-processing logic. Apple's advisories indicate the fix adds explicit bounds checking in the affected code path, preventing reads past allocated memory regions.

Attack Vector

Exploitation requires a victim to open or process maliciously crafted web content in a vulnerable WebKit-based application. Common delivery methods include phishing links, embedded iframes in compromised sites, and in-app browsers that render untrusted HTML. No elevated privileges are required, but user interaction is necessary to load the content.

No verified public proof-of-concept code is available for CVE-2024-40780. See Apple's advisories for the technical scope of the fix.

Detection Methods for CVE-2024-40780

Indicators of Compromise

Repeated unexpected crashes of Safari or WebKit-backed applications when visiting specific URLs
.ips crash report entries in ~/Library/Logs/DiagnosticReports/ referencing WebContent or com.apple.WebKit.WebContent process termination
Browser history or MDM telemetry showing navigation to unknown domains immediately preceding WebKit crashes

Detection Strategies

Collect and aggregate macOS and iOS crash reports to flag recurring WebKit WebContent process crashes across the fleet
Monitor endpoint logs for abnormal frequency of Safari process restarts correlated with specific referrers
Correlate web proxy logs with endpoint crash telemetry to identify URLs that consistently trigger renderer termination

Monitoring Recommendations

Track Apple OS and Safari version inventory via mobile device management (MDM) to identify endpoints below patched versions
Alert on Safari and WebKit-based apps running builds older than Safari 17.6, iOS/iPadOS 16.7.9, iOS/iPadOS 17.6, macOS 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6
Review threat intelligence feeds for domains distributing malformed web content targeting WebKit

How to Mitigate CVE-2024-40780

Immediate Actions Required

Update affected devices to Safari 17.6, iOS/iPadOS 16.7.9 or 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6 or later
Enforce patched OS baselines through MDM policy for all managed Apple endpoints
Instruct users to avoid clicking links from untrusted sources until patches are confirmed installed

Patch Information

Apple published fixes in multiple advisories corresponding to each product line. Refer to Apple Support Article HT214116, HT214117, HT214119, HT214121, HT214122, HT214123, and HT214124. A corresponding WebKitGTK update is tracked in the Debian LTS Announcement.

Workarounds

Restrict Safari and WebKit-based browsing to trusted sites until updates are deployed
Deploy enterprise content filtering to block domains serving suspicious or malformed web content
Disable JavaScript on untrusted sites through MDM-managed Safari configuration profiles where feasible

bash

# Verify macOS version meets the patched baseline
sw_vers -productVersion

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger software update check
sudo softwareupdate -l
sudo softwareupdate -ia --restart