TI-2024-36553 Aliases CVE-2024-54469 GHSA-397j-v2wc-mwf3

Information disclosure in Apple iOS and iPadOS

LOW 24CWE-200Published 2025-03-10 · Updated 2026-06-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. A local user may be able to leak sensitive user information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00232 14th percentileScored 2026-11-07

Fix Fixed iOS and iPadOS (Apple): 18macOS (Apple): 13.7, 14.7, 15+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	iOS and iPadOS	before 18	18	Patch available	CNA
Apple	macOS	before 13.7; before 14.7; before 15	13.7, 14.7, 15	Patch available	CNA
Apple	visionOS	before 2	2	Patch available	CNA

iOS and iPadOS VendorApple Affected before 18 Fixed in 18 Patch available CNA
macOS VendorApple Affected before 13.7; before 14.7; before 15 Fixed in 13.7, 14.7, 15 Patch available CNA
visionOS VendorApple Affected before 2 Fixed in 2 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:apple:ipados::::::::	before 18.0	Vulnerable	Apple
cpe:2.3:o:apple:iphone_os::::::::	before 18.0	Vulnerable	Apple
cpe:2.3:o:apple:macos::::::::	before 13.7; 14.0 to before 14.7	Vulnerable	Apple
cpe:2.3:o:apple:visionos::::::::	before 2.0	Vulnerable	Apple

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 18.0 Vulnerable ·Apple
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 18.0 Vulnerable ·Apple
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 13.7; 14.0 to before 14.7 Vulnerable ·Apple
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·Apple

Remediation

Fix · CNA iOS and iPadOS (Apple) Fixed in 18
Fix · CNA macOS (Apple) Fixed in 13.7, 14.7, 15
Fix · CNA visionOS (Apple) Fixed in 2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-03-10
Apple iOS and iPadOS 18
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2024-29789 Uncontrolled resource consumption in Apple iOS and iPadOSPriority LOW 39
- TI-2024-36551 Information disclosure in Apple SafariPriority LOW 30
- TI-2024-29758 Uncontrolled resource consumption in Apple SafariPriority LOW 29
Show all 6 records →
Release · 2025-03-10
Apple visionOS 2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2024-36551 Information disclosure in Apple SafariPriority LOW 30
- TI-2024-29758 Uncontrolled resource consumption in Apple SafariPriority LOW 29
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-54469
2026-10-03 Alias added: GHSA-397j-v2wc-mwf3

References

Advisory 5

TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2022-06854 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8

See all 2382 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences