CVE-2024-40786

Published: Jul 29, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

This issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8. An attacker may be able to view sensitive user information.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos

3 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	version < 16.7.9
Apple Ipados	17.0 ≤ version < 17.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	version < 16.7.9
Apple Iphone Os	17.0 ≤ version < 17.6

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	version < 13.6.8

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (12)

https://support.apple.com/en-us/120908

Source: product-security@apple.com

https://support.apple.com/en-us/120909

Source: product-security@apple.com

https://support.apple.com/en-us/120912

Source: product-security@apple.com

http://seclists.org/fulldisclosure/2024/Jul/16