CVE-2024-40799 Overview
CVE-2024-40799 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Apple operating systems. Processing a maliciously crafted file can cause the affected application to read memory outside allocated bounds, leading to unexpected app termination. Apple addressed the issue with improved input validation across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw requires local access and user interaction, such as opening a crafted file. Apple published fixes in iOS 16.7.9, iPadOS 16.7.9, iOS 17.6, iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, visionOS 1.3, and watchOS 10.6.
Critical Impact
A maliciously crafted file can trigger an out-of-bounds read that terminates the target application on affected Apple devices.
Affected Products
- Apple iOS and iPadOS (versions prior to 16.7.9 and 17.6)
- Apple macOS Monterey (prior to 12.7.6), Ventura (prior to 13.6.8), and Sonoma (prior to 14.6)
- Apple tvOS (prior to 17.6), visionOS (prior to 1.3), and watchOS (prior to 10.6)
Discovery Timeline
- 2024-07-29 - CVE-2024-40799 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-40799
Vulnerability Analysis
CVE-2024-40799 is classified as an out-of-bounds read [CWE-125]. The affected component fails to validate input length or structure before reading from a memory buffer during file processing. When a crafted file is parsed, the code accesses memory beyond the intended allocation boundary. This condition results in unexpected application termination on the affected device.
Apple resolved the issue by adding improved input validation in the file-parsing routines. The vulnerability requires local access and user interaction, such as opening or previewing a malicious file. Successful exploitation impacts application availability but does not, per Apple's advisory, provide arbitrary code execution.
Root Cause
The root cause is missing or insufficient bounds checking when the affected Apple software parses attacker-controlled file data. Fields inside the crafted file drive read offsets or lengths that exceed the allocated buffer. Because the parser trusts these values without validation, it dereferences memory outside the buffer, producing an out-of-bounds read.
Attack Vector
An attacker delivers a maliciously crafted file to a user of an affected Apple operating system. The user must open or process the file with a vulnerable application. The parser reads past the allocated buffer, corrupting internal state and causing the process to terminate. Delivery channels include email attachments, messaging apps, file shares, and web downloads.
See the Apple Support advisories for details on the fixed components in each operating system.
Detection Methods for CVE-2024-40799
Indicators of Compromise
- Repeated or unexpected crashes of file-parsing applications on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS.
- Presence of untrusted files delivered through email, messaging, or web download that coincide with application termination.
- Crash reports referencing out-of-bounds memory access in system frameworks that process file formats.
Detection Strategies
- Review macOS DiagnosticReports and iOS crash logs for repeated terminations tied to file parsing.
- Correlate file open events with subsequent process crashes to identify suspicious file-driven termination patterns.
- Track Apple OS build versions across managed devices and flag endpoints still running pre-patch releases.
Monitoring Recommendations
- Ingest MDM inventory data to identify devices running versions earlier than iOS/iPadOS 17.6, macOS 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6.
- Monitor email gateways and web proxies for delivery of unusual file types targeting Apple platforms.
- Alert on abnormal crash frequency for specific applications on Apple endpoints in a short time window.
How to Mitigate CVE-2024-40799
Immediate Actions Required
- Update all Apple devices to the fixed versions: iOS/iPadOS 16.7.9 or 17.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6.
- Enforce patch deployment through your Mobile Device Management (MDM) solution and validate compliance across the fleet.
- Instruct users to avoid opening files from untrusted sources until patching is complete.
Patch Information
Apple released patches on July 29, 2024. Consult the vendor advisories for per-platform details: HT214116, HT214117, HT214118, HT214119, HT214120, HT214122, HT214123, and HT214124.
Workarounds
- Restrict opening of files originating from untrusted email, messaging, or web sources on unpatched Apple devices.
- Use MDM configuration profiles to block installation of applications that render high-risk file formats until patches are deployed.
- Apply email and web gateway policies to filter attachments and downloads that could trigger the vulnerable parser.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
