CVE-2024-23225: Apple OS Kernel Memory Corruption Bypasses Memory Protections

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a kernel memory-protection bypass with confirmed in-the-wild exploitation and a CISA KEV deadline, though it requires pre-existing local kernel access and low privileges.

What it is

A memory corruption issue (out-of-bounds write, CWE-787) in Apple's kernel was fixed with improved validation across iOS, iPadOS, macOS, tvOS, visionOS and watchOS. An attacker who already holds arbitrary kernel read and write capability can use it to bypass kernel memory protections, and Apple states the issue may have been exploited.

Impact

An attacker with existing kernel read/write primitives gains the ability to defeat kernel memory protections, which can enable further privilege escalation or persistence at the kernel level. The flaw itself does not grant initial kernel access; it removes a protection layer once that access exists.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it is reached by code already running on the device rather than over the network. No remote or unauthenticated path is described in the record.

Exploitation

Apple states the issue may have been exploited, and CISA added it to KEV on 2024-03-06 with a 2024-03-27 remediation due date. EPSS is low at roughly 1.5% (72nd percentile), and no ransomware campaign use is documented.

What to do

• Update to the fixed versions: iOS 16.7.6/17.4, iPadOS 16.7.6/17.4, macOS Monterey 12.7.4, Ventura 13.6.5, Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4.
• Treat unpatched devices as exposed and prioritize them per the CISA KEV due date of 2024-03-27.
• Restrict installation of untrusted apps and profiles that could deliver local exploit code.
• Monitor for and remove jailbreak or kernel-level tampering tooling on managed devices.
• Verify patch state across all Apple platforms in scope, not just iPhone and Mac.

Detection

• Inventory Apple devices and compare OS builds against the fixed versions listed in the Apple advisories.
• Alert on jailbreak indicators, unexpected kernel extensions, or unsigned code execution on managed endpoints.
• Correlate endpoint telemetry for local privilege escalation or memory-protection bypass attempts following suspicious app installs.
• Track CISA KEV status and confirm remediation before the 2024-03-27 due date.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.