CVE-2014-4404 Apple OS X Heap-Based Buffer Overflow

Exploited in the wild High 7.8 Published 18 Sep 2014 Updated 22 Oct 2025

Attackers can execute arbitrary code with elevated privileges via crafted key-mapping properties in iOS and Apple TV applications.

Exploited in the wild: Since 10 Feb 2022
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2014-4404?

CVE-2014-4404 is a high-severity memory corruption vulnerability in Apple Iphone Os, published on 18 Sep 2014. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.

Weakness: CWE-787

Which versions are affected by CVE-2014-4404?

It affects 3 products.

Products include Apple Iphone Os, Apple Mac Os X, Apple Tvos.

How do I fix CVE-2014-4404?

No fix has been published for CVE-2014-4404 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-4404 being exploited?

Yes. Attackers have exploited CVE-2014-4404 in the wild since at least 10 Feb 2022.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

All Apple Iphone Os vulnerabilities

Sources

Also known as GHSA-frxp-ch88-g8fc.