VIR Vulnerability Intelligence Relay

CVE-2014-4388

high
Published 2014-09-18 · Modified 2026-05-06
CVSS v3
7.8
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2
9.3
VIR risk
7.8

Description

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4418.

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — https://support.apple.com/kb/HT6535

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://support.apple.com/kb/HT6443

OS impact
OSVersionStatusFixed in
macos macosaffected
macos macos7.0affected
macos macos7.0.1affected
macos macos7.0.2affected
macos macos7.0.3affected
macos macos7.0.4affected
macos macos7.0.5affected
macos macos7.0.6affected
macos macos7.1affected
macos macos7.1.1affected
macos macos6.0affected
macos macos6.0.1affected
macos macos6.0.2affected
macos macos6.1affected
macos macos6.1.1affected
macos macos6.1.2affected

References

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.