VIR Vulnerability Intelligence Relay

CVE-2014-4380

critical
Published 2014-09-18 · Modified 2026-05-06
CVSS v3
—
CVSS v2
9.3
VIR risk
9.3

Description

The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows attackers to execute arbitrary code in the kernel's context via a crafted application.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — https://support.apple.com/HT204659

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

OS impact
OSVersionStatusFixed in
macos macosaffected
macos macos6.0affected
macos macos6.0.1affected
macos macos6.0.2affected
macos macos6.1affected
macos macos6.1.1affected
macos macos6.1.2affected
macos macos7.0affected
macos macos7.0.1affected
macos macos7.0.2affected
macos macos7.0.3affected
macos macos7.0.4affected
macos macos7.0.5affected
macos macos7.0.6affected
macos macos7.1affected
macos macos7.1.1affected

References

CWEs

CWE-119

Verify integrity in audit chain (admin only). AS-IS.