CVE-2024-40852: Apple iPadOS Authentication Bypass Vulnerability

CVE-2024-40852 Overview

CVE-2024-40852 is an information disclosure vulnerability affecting Apple iOS and iPadOS devices operating in Assistive Access mode. An attacker with physical access to a locked device can view recent photos without authentication. Apple addressed the issue by restricting the options exposed on a locked device. The fix ships in iOS 18 and iPadOS 18.

The vulnerability is tracked under [CWE-862: Missing Authorization]. It carries an EPSS probability of 0.482% at the 40.576 percentile as of the most recent scoring date.

Critical Impact
Unauthorized viewing of recent photos on a locked iOS or iPadOS device configured with Assistive Access, resulting in exposure of user image data without any credential entry.

Affected Products

Apple iOS versions prior to 18
Apple iPadOS versions prior to 18
Devices configured with Assistive Access mode enabled

Discovery Timeline

2024-09-17 - CVE-2024-40852 published to the National Vulnerability Database
2024-09-17 - Apple releases iOS 18 and iPadOS 18 addressing the issue via Apple Support Document 121250
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-40852

Vulnerability Analysis

Assistive Access is an Apple accessibility feature that simplifies the iOS and iPadOS interface for users with cognitive disabilities. The mode restricts available applications and controls to reduce complexity. The vulnerability stems from insufficient enforcement of authentication requirements within this simplified interface.

An attacker with physical possession of a locked device configured for Assistive Access can navigate to a surface that exposes recent photos. The device does not require the passcode, Face ID, or Touch ID before rendering the images. This bypasses the authentication boundary that normally protects photo library content on a locked device.

The root issue is categorized as Missing Authorization [CWE-862]. Apple's fix restricts the options offered on the lock screen so that photo surfaces are no longer reachable without authentication.

Root Cause

The Assistive Access lock screen presented user interface options that internally referenced recent photo content. Authorization checks required for standard iOS lock screen views were not consistently applied to the Assistive Access equivalents. This produced an authorization gap between the two lock experiences.

Attack Vector

Exploitation requires physical access to a locked device that is running a vulnerable iOS or iPadOS version and configured with Assistive Access. No credentials, tools, or user interaction from the legitimate owner are required. The attacker interacts with the locked device interface directly to reach the exposed photo view. Additional technical details are described in the Full Disclosure mailing list post.

No public exploit code, proof-of-concept repository, or ExploitDB entry is currently associated with this CVE.

Detection Methods for CVE-2024-40852

Indicators of Compromise

Unexpected use of the Photos surface on a device configured with Assistive Access while the device was reported as locked.
User reports of viewed or accessed photos that do not correlate with the account owner's activity.
Devices found unlocked into Assistive Access views without a corresponding successful authentication event.

Detection Strategies

Inventory managed Apple devices through mobile device management (MDM) and identify endpoints running iOS or iPadOS versions earlier than 18.
Flag devices where Assistive Access is enabled and the operating system version is unpatched.
Correlate physical access reports with device usage logs available through MDM audit telemetry.

Monitoring Recommendations

Configure MDM compliance policies to alert when enrolled devices remain on iOS or iPadOS versions below 18.
Monitor for repeated failed unlock attempts and out-of-hours device activity, particularly on shared or accessibility-configured devices.
Review Apple security advisories on a recurring basis and track patch adoption across the mobile fleet.

How to Mitigate CVE-2024-40852

Immediate Actions Required

Update all affected iPhone and iPad devices to iOS 18 or iPadOS 18 or later.
Prioritize patching for devices configured with Assistive Access, as they are directly exposed to this issue.
Enforce update compliance through MDM policies for organization-managed devices.

Patch Information

Apple addressed CVE-2024-40852 in iOS 18 and iPadOS 18 by restricting the options offered on a locked device. Full remediation details are published in the Apple Support advisory. Devices upgraded to these versions are no longer affected by the described bypass.

Workarounds

Disable Assistive Access on devices that cannot be updated immediately, if the feature is not operationally required.
Maintain physical control of devices configured with Assistive Access and store them in secured locations when unattended.
Educate caregivers and administrators supporting Assistive Access users to report any unexpected access to photo content.

bash

# Verify iOS or iPadOS version on a managed device via MDM query
# Example: Apple MDM DeviceInformation query returns the OSVersion key
# Ensure OSVersion is 18.0 or later on all enrolled devices
# Sample compliance check pseudocode:
if device.os_version < "18.0":
    mark_noncompliant(device)
    enforce_update(device)