CVE-2024-40779

What it actually does

Out-of-bounds read in WebKit due to insufficient bounds checking allows malicious web content to trigger an unexpected process crash.

Why it matters to the business

Crashes in Safari and other Apple browsers or apps can interrupt user workflows and reduce availability of web-dependent services across iOS, macOS, and related platforms.

How an attack unfolds

An attacker creates specially crafted web content that triggers the out-of-bounds read when rendered by WebKit; the victim is lured to the page via phishing or compromised sites, resulting in a process crash without further code execution.

How to fix it

Upgrade to Safari 17.6, iOS 16.7.9, iPadOS 16.7.9, iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6 (or later versions) on all affected devices.

How to confirm the fix worked

Verify installed versions of Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS against the fixed releases; retest with known trigger content if available in a lab environment.

Typical attack path

1. Craft malicious HTML/JS content that triggers the out-of-bounds read
2. Host the content on an attacker-controlled or compromised website
3. Deliver a lure (email, message, or link) to the victim
4. Victim loads the page in an affected browser or app
5. WebKit process crashes

How to detect it

Review system and application crash logs for WebKit processes that terminate unexpectedly when rendering web content; correlate with browsing history for recently visited sites.

What your security team should do

• Apply the listed updates to all managed Apple devices as soon as possible
• Enable automatic updates where feasible to reduce future exposure windows
• Monitor crash reports for WebKit-related terminations as an interim signal