CVE-2024-40789

What it actually does

Out-of-bounds memory access in WebKit due to insufficient bounds checking when processing crafted web content, resulting in a process crash with high availability impact.

Why it matters to the business

Users on unpatched Apple devices may experience sudden browser or app crashes while browsing the web, leading to lost productivity, interrupted workflows, and potential user frustration across Safari, iOS, macOS, and other platforms.

How an attack unfolds

An attacker crafts a malicious web page containing specially formatted content designed to trigger the out-of-bounds access. The victim is tricked into visiting the page via phishing or compromised sites. Upon rendering, WebKit processes the content, the flaw is triggered, and the browser or associated process crashes without further exploitation observed.

How to fix it

Update affected devices to the fixed releases: Safari 17.6, iOS 16.7.9, iPadOS 16.7.9, iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6. Apply updates as soon as possible through standard system update mechanisms.

How to confirm the fix worked

Verify device and application versions match or exceed the listed fixed releases. Test by attempting to render known trigger content in a lab environment and confirm no crash occurs. Monitor update logs for successful installation of the referenced versions.

Typical attack path

1. Attacker prepares a web page with maliciously crafted content targeting WebKit bounds checking
2. Victim is directed to the page through social engineering or compromised legitimate sites
3. WebKit renders the page on an affected Apple device or browser
4. Out-of-bounds access occurs, causing an unexpected process crash

How to detect it

Review system and application crash logs for WebKit, Safari, or browser process terminations coinciding with web content rendering. Correlate with network logs showing visits to untrusted domains around the time of crashes.

What your security team should do

• Prioritize deployment of the listed Apple security updates across all managed devices
• Enable automatic updates where feasible to reduce exposure window
• Educate users on avoiding suspicious links until patches are applied
• Monitor for any increase in WebKit-related crash reports as an early indicator