---
id: "CVE-2024-23296"
kind: "vulnerability"
aliases: ["CVE-2024-23296"]
title: "A memory corruption issue was addressed with improved validation"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["16.7.8"], "affected": "< 16.7.8", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["17.4"], "affected": ">= 17.0, < 17.4", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["16.7.8"], "affected": "< 16.7.8", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["17.4"], "affected": ">= 17.0, < 17.4", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["12.7.6"], "affected": ">= 12.0, < 12.7.6", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["13.6.7"], "affected": ">= 13.0, < 13.6.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.4"], "affected": ">= 14.0, < 14.4", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["17.4"], "affected": "< 17.4", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["1.1"], "affected": "< 1.1", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["10.4"], "affected": "< 10.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "infrastructure", "ios", "ipados", "macos", "tvos", "watchos"]
not_affected_if: ["unpatched-builds-not-in-use"]
published_at: "2024-03-05T20:16:01+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23296", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23296", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A memory corruption issue was addressed with improved validation

A memory corruption flaw in RTKit, the real-time OS that runs on Apple's coprocessors, in iOS, iPadOS, macOS, tvOS and watchOS. An attacker who already has arbitrary kernel read and write can use it to bypass kernel memory protections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple ipados affected < 16.7.8 fixed 16.7.8
- vendor:apple ipados affected >= 17.0, < 17.4 fixed 17.4
- vendor:apple iphone os affected < 16.7.8 fixed 16.7.8
- vendor:apple iphone os affected >= 17.0, < 17.4 fixed 17.4
- vendor:apple macos affected >= 12.0, < 12.7.6 fixed 12.7.6
- vendor:apple macos affected >= 13.0, < 13.6.7 fixed 13.6.7
- vendor:apple macos affected >= 14.0, < 14.4 fixed 14.4
- vendor:apple tvos affected < 17.4 fixed 17.4
- vendor:apple visionos affected < 1.1 fixed 1.1
- vendor:apple watchos affected < 10.4 fixed 10.4

## Fix

Update Apple devices to the latest iOS, iPadOS, macOS, tvOS and watchOS releases, as Apple's security notes for this CVE describe; the exact fixed versions are unknown from the sources.
CISA's required action is to apply Apple's mitigations or stop using the affected products if none exist.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23296
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-23296

## From the sources

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_