CVE-2018-4344 is a critical memory corruption vulnerability affecting Apple's iOS (prior to 12), macOS Mojave (prior to 10.14), tvOS (prior to 12), and watchOS (prior to 5). With a CVSS score of 7.8 (HIGH), it allows an unauthenticated attacker to achieve high impact to confidentiality, integrity, and availability through user interaction, indicating a significant risk. This flaw has been actively exploited in the wild, as confirmed by its presence in the KEV catalog, and has garnered notable community discussion and media coverage, including reports of spyware deployment against affected users. Despite its active exploitation, no public exploit code is available in Metasploit, Nuclei, or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.0CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
< 10.14CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
< 12.0CPE matchmatch criteria | cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | ||
< 5.0CPE matchmatch criteria | cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.