CVE-2024-23296 Apple Multiple Products Memory Corruption

Exploited in the wild High 7.8 Published 5 Mar 2024 Updated 2 Apr 2026

An attacker with kernel read/write access can bypass kernel memory protections, potentially leading to privilege escalation on Apple devices.

Exploited in the wild: Since 6 Mar 2024
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-23296?

CVE-2024-23296 is a high-severity memory corruption vulnerability in Apple Ipados, published on 5 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Weakness: CWE-787

Which versions are affected by CVE-2024-23296?

It affects 6 products.

Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Tvos, Apple Visionos, Apple Watchos.

How do I fix CVE-2024-23296?

No fix has been published for CVE-2024-23296 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 27 Mar 2024.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-23296 being exploited?

Yes. Attackers have exploited CVE-2024-23296 in the wild since at least 6 Mar 2024.

Public exploit code: 1 proofs of concept on GitHub.

All Apple Ipados vulnerabilities

Sources

Also known as GHSA-v4rc-hq4f-4cmp.