CVE-2024-40852: High severity Apple iOS and iPadOS vulnerability

Q: What is the severity of CVE-2024-40852?

CVE-2024-40852 has been classified with a severity that indicates potential risks associated with accessibility features in Apple devices.

Q: How do I fix CVE-2024-40852?

To fix CVE-2024-40852, users should update their Apple iOS or iPadOS to version 18 or later.

Q: What devices are affected by CVE-2024-40852?

CVE-2024-40852 affects Apple devices running iOS and iPadOS versions prior to 18.0.

Q: What type of issue does CVE-2024-40852 address?

CVE-2024-40852 addresses accessibility vulnerabilities that could affect data protection and state management.

Q: Is CVE-2024-40852 related to device security?

Yes, CVE-2024-40852 is related to device security by addressing potential risks when using accessibility options on locked devices.

Published Sep 16, 2024

Updated

Accessibility. This issue was addressed by restricting options offered on a locked device.

Other sources

Accessibility. This issue was addressed through improved state management.

— Apple

Accessibility. This issue was addressed with improved data protection.

— Apple

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access.

— MITRE

Credit

Chloe Surett, Jake Derouin (jakederouin.com), Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal India), Holger Fuhrmannek, Tuan D. Hoang, Snoolie Keffaber@@0xilis, an anonymous researcher, Daniele Antonioli, Csaba Fitzl@@theevilbit(Kandji), @@08Tc3wBB(Jamf), Denis Tokarev@@illusionofcha0s, Junsung Lee, dw0r(ZeroPointer Lab working with Trend Micro Zero Day Initiative), Antonio Zekić, Andrew Lytvynov, Alexander Heinrich, SEEMOO, DistriNet, KU Leuven@@vanhoefm, TU Darmstadt@@Sn0wfreeze, Mathy Vanhoef, Kirin@@Pwnrin, Jeff Johnson (underpassapp.com), OSS-Fuzz(Google Project Zero), Ned Williamson(Google Project Zero), Rodolphe BRUNETTI@@eisw0lf, Olivier Levon, CVE-2023-5841, ajajfxhj, Bistrit Dahal, Joshua Keller, Lukas, Narendra Bhati(Cyber Security at Suma Soft Pvt), Manager(Cyber Security at Suma Soft Pvt), Pune (India), Kenneth Chew, Anamika Adhikari, 냥냥, Wojciech Regula(SecuRing), Om Kothawade(Zaprico Digital), Omar A. Alanis(the UNTHSC College of Pharmacy), Matej Moravec@@MacejkoMoravec, Chi Yuan Chang(ZUSO ART), taikosoup, Srijan Poudel, K宝, LFY@@secsys, Smi1e, yulige, Cristian Dinca (icmd.tech), Ron Masas(BreakPoint), Bohdan Stasiuk@@Bohdan_Stasiuk, Justin Cohen, Narendra Bhati(Cyber Security At Suma Soft Pvt), Manager(Cyber Security At Suma Soft Pvt), Tashita Software Security, Ron Masas, Tim Michaud@@TimGMichaud(Moveworks), Preet Dsouza (Fleming College, Computer Security & Investigations Program), Domien Schepers

Affected Software

4 affected componentsFixes available

Apple iOS and iPadOS<18

Apple iOS, iPadOS, and macOS<18

Apple iOS, iPadOS, and macOS<18.0

iPhone OS<18.0

Event History

Sep 16, 2024

CVE Published

via MITRE·11:23 PM

Data Sourced

via MITRE·11:23 PM

DescriptionWeakness

Sep 17, 2024

Data Sourced

via NVD·12:15 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

APPLE-121250

Frequently Asked Questions

What is the severity of CVE-2024-40852?

CVE-2024-40852 has been classified with a severity that indicates potential risks associated with accessibility features in Apple devices.

How do I fix CVE-2024-40852?

To fix CVE-2024-40852, users should update their Apple iOS or iPadOS to version 18 or later.

What devices are affected by CVE-2024-40852?

CVE-2024-40852 affects Apple devices running iOS and iPadOS versions prior to 18.0.

What type of issue does CVE-2024-40852 address?