What is CVE-2024-23222?

CVE-2024-23222 is a high-severity vulnerability affecting various Apple devices, including those running iOS, iPadOS, macOS, and tvOS. This type confusion issue, which has been addressed with improved checks, could lead to arbitrary code execution when processing malicious web content. It is important to note that there have been reports of this vulnerability being exploited. To protect your devices, ensure they are updated to the latest software versions.

Who is impacted by CVE-2024-23222?

If you use Apple devices, you might be affected by the CVE-2024-23222 vulnerability. This issue impacts various Apple products, including iOS (versions up to 16.7.5 and 17.0 to 17.3), iPadOS (versions up to 16.7.5 and 17.0 to 17.3), macOS (versions up to 12.7.3, 13.0 to 13.6.4, and 14.0 to 14.3), and tvOS (versions up to 17.3). Users of Apple TV HD and Apple TV 4K (all models) who process malicious web content may also be at risk, as this could lead to arbitrary code execution on their devices.

What to do if CVE-2024-23222 affected you

If you're affected by the CVE-2024-23222 vulnerability, it's crucial to take action to secure your devices. Follow these simple steps to protect yourself:

1. Update your Apple devices to the latest software versions, such as iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and tvOS 17.3.

2. For Apple TV users, ensure you have updated to tvOS 17.3 to receive the necessary security fixes.

3. Regularly check for software updates and apply them promptly to avoid future vulnerabilities.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, the CVE-2024-23222 vulnerability is in CISA's Known Exploited Vulnerabilities Catalog. It is named "Apple Multiple Products WebKit Type Confusion Vulnerability" and was added on January 23, 2024. The due date for required action is February 13, 2024. To mitigate the risk, users should apply vendor-provided fixes or discontinue using the affected products if no mitigations are available.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-843, which is a type confusion issue in Apple's WebKit.

Learn More

For a comprehensive analysis of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page and the sources listed below.

• Apple Support: About the security content of tvOS 17.3

• CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities