CVE-2024-54658 Overview
CVE-2024-54658 is a denial-of-service vulnerability affecting Apple's WebKit browser engine across Safari and multiple Apple operating systems. Processing malicious web content can cause the affected application to become unresponsive or crash. Apple addressed the issue with improved memory handling in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. Exploitation requires user interaction, typically visiting a crafted web page.
Critical Impact
A remote attacker can trigger a denial-of-service condition in Safari or the WebKit rendering engine by luring a user to malicious web content, disrupting browser availability across Apple's ecosystem.
Affected Products
- Apple Safari (prior to 17.4)
- Apple iOS and iPadOS (prior to 17.4)
- Apple macOS Sonoma (prior to 14.4), tvOS (prior to 17.4), visionOS (prior to 1.1), watchOS (prior to 10.4)
Discovery Timeline
- 2025-02-10 - CVE-2024-54658 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54658
Vulnerability Analysis
CVE-2024-54658 resides in Apple's WebKit engine, which powers Safari and web content rendering across Apple platforms. When WebKit processes specifically crafted web content, memory handling errors lead to uncontrolled resource consumption. The result is a denial-of-service condition affecting the browser process or the embedded web view. The vulnerability does not expose confidential data or permit modification of system state, but it disrupts availability of web content processing.
Root Cause
Apple's advisories attribute the flaw to memory handling deficiencies that were resolved through improved memory management. The condition maps to [CWE-400] Uncontrolled Resource Consumption. Malformed input consumed during content parsing or rendering leads WebKit into a state where memory usage grows unchecked or produces a fatal fault, terminating the process.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker hosts crafted content on a web page or delivers it through an embedded WebView, iframe, or messaging preview. When the victim loads the content, WebKit's parsing or rendering path triggers the memory fault. Because WebKit is shared across Safari, Mail previews, and third-party apps using WKWebView, the attack surface extends beyond Safari itself. See the Apple Support Document 120895 for vendor details.
No verified public exploit or proof-of-concept code is currently available. Refer to Apple's advisories for authoritative technical details.
Detection Methods for CVE-2024-54658
Indicators of Compromise
- Repeated Safari or WebKit-based application crashes correlated with visits to specific URLs or opening of particular content previews.
- Unexpected termination of com.apple.WebKit.WebContent or com.apple.WebKit.Networking processes in unified logs.
- Crash reports referencing WebKit frames generated in ~/Library/Logs/DiagnosticReports/ on macOS or synced from iOS devices.
Detection Strategies
- Inspect diagnostic and crash logs for WebKit process terminations following web navigation events.
- Correlate endpoint browser telemetry with URL access history to identify content that reliably triggers browser crashes.
- Monitor mobile device management (MDM) inventories for Apple endpoints reporting OS or Safari versions below the patched builds.
Monitoring Recommendations
- Track Safari and Apple OS versions across the fleet and flag devices running builds earlier than Safari 17.4, iOS/iPadOS 17.4, macOS 14.4, tvOS 17.4, visionOS 1.1, or watchOS 10.4.
- Alert on abnormal rates of WebKit process crashes across managed endpoints, which may indicate targeted content delivery.
- Ingest browser and OS telemetry into a centralized data lake to enable retrospective hunting for repeated crash patterns.
How to Mitigate CVE-2024-54658
Immediate Actions Required
- Update all Apple endpoints to Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4 or later.
- Push updates through MDM to enforce compliance on managed iOS, iPadOS, and macOS devices.
- Prioritize devices used to browse untrusted content or process email previews rendered by WebKit.
Patch Information
Apple resolved CVE-2024-54658 with improved memory handling in the following releases: Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. Consult the vendor advisories at Apple Support Document 120881, Apple Support Document 120882, Apple Support Document 120883, Apple Support Document 120893, Apple Support Document 120894, and Apple Support Document 120895.
Workarounds
- Restrict browsing to trusted domains and avoid opening links from unknown senders on unpatched devices.
- Use enterprise content filtering to block known malicious URLs and reduce exposure to crafted WebKit content.
- Disable Safari previews and JavaScript on high-risk endpoints where immediate patching is not feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
