TI-2024-29724 Aliases CVE-2024-44157 GHSA-q557-m5m4-m7pc

Buffer overflow in Apple TV

LOW 24CWE-120Published 2024-10-11 · Updated 2026-04-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Parsing a maliciously crafted video file may lead to unexpected system termination.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00204 10th percentileScored 2026-11-07

Fix Fixed Apple TV (Apple): 1.5.0iTunes for Windows (Apple): 12.13.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	Apple TV	before 1.5.0	1.5.0	Patch available	CNA
Apple	iTunes for Windows	before 12.13.3	12.13.3	Patch available	CNA

Apple TV VendorApple Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
iTunes for Windows VendorApple Affected before 12.13.3 Fixed in 12.13.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:apple_tv::::::windows::*	before 1.5.0.152	Vulnerable	Apple
cpe:2.3:a:apple:itunes::::::windows::*	before 12.13.3	Vulnerable	Apple

cpe:2.3:a:apple:apple_tv:*:*:*:*:*:windows:*:* Versions before 1.5.0.152 Vulnerable ·Apple
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* Versions before 12.13.3 Vulnerable ·Apple

Remediation

Fix · CNA Apple TV (Apple) Fixed in 1.5.0
Fix · CNA iTunes for Windows (Apple) Fixed in 12.13.3

Timeline

2026-10-02 Threatist record created from CVE-2024-44157
2026-10-03 Alias added: GHSA-q557-m5m4-m7pc

References

Advisory 2

TI-2018-03197 Memory corruption in Apple Kernel CVSS 3.0HIGH 7.8
TI-2018-03047 Memory corruption in Apple WebKit CVSS 3.0HIGH 8.8
TI-2017-01643 Memory corruption in Apple WebKit CVSS 3.0HIGH 8.8
TI-2018-03248 In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update… CVSS 3.0CRITICAL 9.8
TI-2018-03195 Memory corruption in Apple Kernel CVSS 3.0HIGH 7.8
TI-2018-03144 In iOS before 11.2.5, macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra… CVSS 3.0CRITICAL 9.8

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences