About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
visionOS 1.2
Released June 10, 2024
CoreMedia
Available for: Apple Vision Pro
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved checks.
CVE-2024-27817: pattern-f (@pattern_F_) of Ant Security Light-Year Lab
CoreMedia
Available for: Apple Vision Pro
Impact: Processing a file may lead to unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2024-27831: Amir Bazine and Karsten König of CrowdStrike Counter Adversary Operations
Disk Images
Available for: Apple Vision Pro
Impact: An app may be able to elevate privileges
Description: The issue was addressed with improved checks.
CVE-2024-27832: an anonymous researcher
Foundation
Available for: Apple Vision Pro
Impact: An app may be able to elevate privileges
Description: The issue was addressed with improved checks.
CVE-2024-27801: CertiK SkyFall Team
ImageIO
Available for: Apple Vision Pro
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: The issue was addressed with improved checks.
CVE-2024-27836: Junsung Lee working with Trend Micro Zero Day Initiative
IOSurface
Available for: Apple Vision Pro
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2024-27828: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple Vision Pro
Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory protections
Description: The issue was addressed with improved memory handling.
CVE-2024-27840: an anonymous researcher
Kernel
Available for: Apple Vision Pro
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2024-27815: an anonymous researcher, and Joseph Ravichandran (@0xjprx) of MIT CSAIL
libiconv
Available for: Apple Vision Pro
Impact: An app may be able to elevate privileges
Description: The issue was addressed with improved checks.
CVE-2024-27811: Nick Wellnhofer
Messages
Available for: Apple Vision Pro
Impact: Processing a maliciously crafted message may lead to a denial-of-service
Description: This issue was addressed by removing the vulnerable code.
CVE-2024-27800: Daniel Zajork and Joshua Zajork
Metal
Available for: Apple Vision Pro
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2024-27802: Meysam Firouzi (@R00tkitsmm) working with Trend Micro Zero Day Initiative
Metal
Available for: Apple Vision Pro
Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2024-27857: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
Safari
Available for: Apple Vision Pro
Impact: A website's permission dialog may persist after navigation away from the site
Description: The issue was addressed with improved checks.
CVE-2024-27844: Narendra Bhati of Suma Soft Pvt. Ltd in Pune (India), Shaheen Fazim
WebKit
Available for: Apple Vision Pro
Impact: A maliciously crafted webpage may be able to fingerprint the user
Description: The issue was addressed by adding additional logic.
WebKit Bugzilla: 262337
CVE-2024-27838: Emilio Cobos of Mozilla
WebKit
Available for: Apple Vision Pro
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 268221
CVE-2024-27808: Lukas Bernhard of CISPA Helmholtz Center for Information Security
WebKit
Available for: Apple Vision Pro
Impact: Processing web content may lead to a denial-of-service
Description: A logic issue was addressed with improved file handling.
CVE-2024-27812: Ryan Pickren (ryanpickren.com)
Entry updated June 20, 2024
WebKit
Available for: Apple Vision Pro
Impact: A maliciously crafted webpage may be able to fingerprint the user
Description: This issue was addressed with improvements to the noise injection algorithm.
WebKit Bugzilla: 270767
CVE-2024-27850: an anonymous researcher
WebKit
Available for: Apple Vision Pro
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
WebKit Bugzilla: 271491
CVE-2024-27833: Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative
WebKit
Available for: Apple Vision Pro
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: The issue was addressed with improved bounds checks.
WebKit Bugzilla: 272106
CVE-2024-27851: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute
WebKit Canvas
Available for: Apple Vision Pro
Impact: A maliciously crafted webpage may be able to fingerprint the user
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 271159
CVE-2024-27830: Joe Rutkowski (@Joe12387) of Crawless and @abrahamjuliot
WebKit Web Inspector
Available for: Apple Vision Pro
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 270139
CVE-2024-27820: Jeff Johnson of underpassapp.com
Additional recognition
ImageIO
We would like to acknowledge an anonymous researcher for their assistance.
Transparency
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.