CVE-2018-4243 is a buffer overflow vulnerability in the Kernel component of Apple iOS before 11.4, macOS before 10.13.5, tvOS before 11.4, and watchOS before 4.3.1. This flaw, specifically within the getvolattrlist function, allows attackers to execute arbitrary code with elevated privileges through a specially crafted application. Rated as High severity (CVSS 7.8), it requires user interaction (UI:R) but has low attack complexity (AC:L) and can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). While not listed in CISA's KEV catalog, an ExploitDB entry (EDB-44848) details a heap overflow, indicating public exploit code availability, and it has garnered significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 11.4CPE matchmatch criteria | cpe:2.3:a:apple:apple_tv:*:*:*:*:*:*:*:* | ||
< 11.4CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
< 10.13.5CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
< 4.3.1CPE matchmatch criteria | cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.