Apple WebKit Arbitrary Code Execution Vulnerability

A buffer overflow vulnerability in the WebKit component of multiple Apple operating systems, including iOS 17.4, iPadOS 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, and macOS Sonoma 14.4, has been identified. This vulnerability allows for arbitrary code execution when processing web content. The issue arises from improper memory handling, which can be exploited by maliciously crafted web content.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with the privileges of the user.

Reproduction

The vulnerability can be reproduced by processing a maliciously crafted image or web content, which triggers the buffer overflow due to inadequate input validation. This can be done through applications that utilize WebKit for rendering content, such as the Safari browser or other apps that embed a web view.

Remediation

Users can update to the latest versions of iOS, iPadOS, tvOS, watchOS, visionOS, or macOS to address this vulnerability.