CVE-2024-23222
A type confusion issue was addressed with improved checks.
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 10.59%
- Chance of exploitation in the next 30 days. Higher than 95.78% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Jan 23, 2024
- Weakness
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- Fix
- None yet
- No fixed version published
Description
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
References
Advisories
- support.apple.com/en-us/118479
- support.apple.com/en-us/120304
- support.apple.com/en-us/120305
- support.apple.com/en-us/120307
- support.apple.com/en-us/120309
- support.apple.com/en-us/120310
- support.apple.com/en-us/120311
- support.apple.com/en-us/120339
- support.apple.com/en-us/126632
- seclists.org/fulldisclosure/2024/Feb/6
- seclists.org/fulldisclosure/2024/Jan/34
- seclists.org/fulldisclosure/2024/Jan/40
- support.apple.com/en-us/HT214055
- support.apple.com/en-us/HT214059
- support.apple.com/en-us/HT214061
- support.apple.com/kb/HT214055
- support.apple.com/kb/HT214056
- support.apple.com/kb/HT214057
- support.apple.com/kb/HT214058
- support.apple.com/kb/HT214059
- support.apple.com/kb/HT214061
- support.apple.com/kb/HT214063
- support.apple.com/kb/HT214070
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Same weakness, CWE-843 |
| GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | Critical | Same weakness, CWE-843 |
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | Critical | Same weakness, CWE-843 |
| GHSA-r9w8-h9r3-54w4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation | High | Same weakness, CWE-843 |
| GHSA-j6r3-76f7-8jcv ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range | Medium | Same weakness, CWE-843 |
| CVE-2026-85046 Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | High Known exploited | Same weakness, CWE-843 |
| GHSA-32r8-5843-4qw2 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure | High | Same weakness, CWE-843 |
| GHSA-2x35-3fw4-9jr4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion | High | Same weakness, CWE-843 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor