CVE-2024-40786

Published: Jul 29, 2024Modified: Apr 2, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

This issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8. An attacker may be able to view sensitive user information.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos

3 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 16.7.9
Apple Ipados	From 17.0 to 17.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Before 16.7.9
Apple Iphone Os	From 17.0 to 17.6

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	Before 13.6.8

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (12)

https://support.apple.com/en-us/120908

Source: product-security@apple.com

https://support.apple.com/en-us/120909

Source: product-security@apple.com

https://support.apple.com/en-us/120912

Source: product-security@apple.com

http://seclists.org/fulldisclosure/2024/Jul/16