CVE-2024-40782

What it actually does

Use-after-free condition in WebKit memory management triggered during processing of malicious web content, resulting in unexpected process termination with high availability impact.

Why it matters to the business

Disrupts user access to web-based services and applications across Apple devices, causing crashes that reduce productivity and require restarts without data loss in most cases; widespread ecosystem prevalence increases exposure for organizations relying on Apple platforms.

How an attack unfolds

An attacker crafts a malicious webpage exploiting the use-after-free flaw in WebKit; when a victim visits the page via Safari or another affected Apple product, the flaw is triggered leading to a process crash. No known threat actors have actively exploited this in campaigns based on available data.

How to fix it

Update affected products to fixed versions: Safari 17.6, iOS 16.7.9, iPadOS 16.7.9, iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Apply updates via standard Apple software update mechanisms and verify installation across all managed devices.

How to confirm the fix worked

Confirm devices are running the listed fixed versions or newer through system information or MDM queries; test by attempting to load known trigger content in a lab environment and verify absence of crashes post-update.

Typical attack path

1. Attacker prepares and hosts a webpage containing maliciously crafted web content targeting WebKit
2. Victim is lured to visit the page through phishing or compromised sites
3. WebKit processes the content and triggers the use-after-free condition
4. Process crashes occur in the browser or app, achieving denial of service

How to detect it

Review system and application crash logs for WebKit-related processes on Apple devices; correlate with web browsing history for unusual or unexpected site visits around crash timestamps. No confirmed exploitation indicators available from public sources.

What your security team should do

• Prioritize deployment of the specified Apple updates to all endpoints within the next patching cycle
• Monitor Apple security release notes for any follow-on advisories
• Educate users on avoiding suspicious links until updates are applied
• Review web filtering controls to block high-risk external content where feasible