CVE-2024-54479: Apple Safari DOS Vulnerability

CVE-2024-54479 Overview

CVE-2024-54479 is a denial of service vulnerability affecting Apple's WebKit browser engine, which powers Safari and other web-rendering components across Apple's ecosystem. The vulnerability stems from insufficient input validation when processing maliciously crafted web content, leading to an unexpected process crash. This affects a wide range of Apple products including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

The vulnerability allows remote attackers to cause a denial of service condition by delivering specially crafted web content to vulnerable devices. Since WebKit is the underlying engine for all web browsing on Apple platforms, users simply visiting a malicious website or loading compromised web content could trigger the exploit.

Critical Impact

Processing maliciously crafted web content may lead to an unexpected process crash, enabling remote denial of service attacks against Apple devices across multiple platforms.

Affected Products

• Apple Safari (versions prior to 18.2)
• Apple iOS (versions prior to 18.2)
• Apple iPadOS (versions prior to 17.7.3 and 18.2)
• Apple macOS Sequoia (versions prior to 15.2)
• Apple tvOS (versions prior to 18.2)
• Apple visionOS (versions prior to 2.2)
• Apple watchOS (versions prior to 11.2)

Discovery Timeline

• December 12, 2024 - CVE-2024-54479 published to NVD
• November 03, 2025 - Last updated in NVD database

Technical Details for CVE-2024-54479

Vulnerability Analysis

This vulnerability exists within Apple's WebKit engine, which is responsible for parsing and rendering web content across all Apple platforms. The core issue involves improper validation checks when processing certain web content elements, which can lead to unexpected process termination.

When WebKit encounters maliciously crafted content, the insufficient validation allows the processing logic to enter an invalid state, resulting in a crash. Since WebKit operates as the browser engine for Safari and handles web content rendering for applications using WKWebView or SFSafariViewController, the impact extends beyond just web browsing to any application that displays web content.

The network-based attack vector means exploitation requires no privileges or user interaction beyond visiting a malicious webpage. An attacker can host crafted content on a website or inject it into legitimate sites through advertising networks or compromised third-party resources.

Root Cause

The vulnerability was addressed with improved checks, indicating that the root cause was insufficient input validation or boundary checking within WebKit's content processing routines. The lack of proper validation allowed malformed or unexpected data structures to trigger a crash condition during parsing or rendering operations.

Apple's fix implements additional validation checks to ensure that web content is properly sanitized and validated before being processed by the rendering engine, preventing the crash condition from being triggered.

Attack Vector

The attack vector for CVE-2024-54479 is network-based and requires no authentication or user interaction beyond loading malicious content. Exploitation scenarios include:

• Directing users to attacker-controlled websites containing crafted content
• Injecting malicious payloads through compromised advertising networks
• Embedding malicious content in emails or messages that auto-render web previews
• Compromising legitimate websites to serve malicious content to visitors

The vulnerability primarily results in availability impact through denial of service, causing the browser or web-rendering process to crash unexpectedly.

Detection Methods for CVE-2024-54479

Indicators of Compromise

• Repeated Safari or WebKit process crashes when accessing specific websites
• Crash reports indicating WebKit-related process terminations in system logs
• Unusual patterns of browser restarts or tab recovery events
• Application crashes in apps utilizing WKWebView components

Detection Strategies

• Monitor system crash logs for WebKit-related process terminations across Safari and other applications
• Implement network traffic analysis to identify patterns associated with known malicious web content delivery
• Deploy endpoint detection solutions to correlate browser crashes with suspicious network activity
• Review application crash reports for patterns indicating exploitation attempts

Monitoring Recommendations

• Enable detailed crash reporting on Apple devices to capture WebKit-related incidents
• Configure network monitoring to track connections to newly registered or suspicious domains
• Implement DNS filtering to block known malicious domains
• Use web content filtering solutions to inspect and block potentially malicious payloads

How to Mitigate CVE-2024-54479

Immediate Actions Required

• Update all affected Apple devices to the patched versions immediately
• Ensure Safari is updated to version 18.2 or later on all systems
• Verify iOS devices are running version 18.2 or later
• Update macOS Sequoia systems to version 15.2 or later
• Enable automatic updates to receive future security patches promptly

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. Organizations should apply the following updates:

• Safari 18.2 - Apple Support Document #121837
• iOS 18.2 and iPadOS 18.2 - Apple Support Document #121838
• iPadOS 17.7.3 - Apple Support Document #121839
• macOS Sequoia 15.2 - Apple Support Document #121843
• tvOS 18.2 - Apple Support Document #121845
• watchOS 11.2 - Apple Support Document #121846
• visionOS 2.2 - Apple Support Document #121844

Additional security information is available via the Full Disclosure mailing list archives and the Debian LTS Security Announcement for WebKitGTK.

Workarounds

• Limit web browsing to trusted websites until patches can be applied
• Use content blockers to prevent loading of potentially malicious advertising content
• Consider using Reader Mode in Safari for untrusted content to reduce JavaScript execution
• Implement network-level filtering to block access to known malicious domains
• For enterprise environments, use mobile device management (MDM) to enforce browser restrictions

# Check Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Verify macOS version
sw_vers -productVersion

# Check for available software updates
softwareupdate --list