CVE-2024-54529
published 2024-12-12CVE-2024-54529: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.33%
25.7th percentile
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | < 13.7.2 | 13.7.2 |
| apple | macos | < 14.7.2 | 14.7.2 |
| apple | macos | < 15.2 | 15.2 |
| apple | macos | >= 13.0 < 13.7.2 | 13.7.2 |
| apple | macos | >= 14.0 < 14.7.2 | 14.7.2 |
| apple | macos | >= 15.0 < 15.2 | 15.2 |
| apple | macos_sequoia | — | — |
| apple | macossonoma14.7.2 | — | — |
| apple | macosventura13.7.2 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2024-54529: macOSVentura13.7.2
vendor_apple·2024-12-11·CVSS 7.8
CVE-2024-54529 [HIGH] CVE-2024-54529: macOSVentura13.7.2
Apple Security Update: About the security content of macOSVentura13.7.2
Product: macOSVentura13.7.2
CVE: CVE-2024-54529
Component: Audio
Impact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges
Description: A logic issue was addressed with improved checks.
Apple
CVE-2024-54529: macOS Sequoia 15.2
vendor_apple·2024-12-11·CVSS 7.8
CVE-2024-54529 [HIGH] CVE-2024-54529: macOS Sequoia 15.2
Apple Security Update: About the security content of macOS Sequoia 15.2
Product: macOS Sequoia
Version: 15.2
CVE: CVE-2024-54529
Component: Audio
Impact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges
Description: A logic issue was addressed with improved checks.
Apple
CVE-2024-54529: macOSSonoma14.7.2
vendor_apple·2024-12-11·CVSS 7.8
CVE-2024-54529 [HIGH] CVE-2024-54529: macOSSonoma14.7.2
Apple Security Update: About the security content of macOSSonoma14.7.2
Product: macOSSonoma14.7.2
CVE: CVE-2024-54529
Component: Audio
Impact: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges
Description: A logic issue was addressed with improved checks.
Project0
Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages - Project Zero
project_zero·2025-05-01
CVE-2024-54529 Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages - Project Zero
Guest post by Dillon Franke, Senior Security Engineer, 20% time on Project Zero
Every second, highly-privileged MacOS system daemons accept and process hundreds of IPC messages. In some cases, these message handlers accept data from sandboxed or unprivileged processes.
In this blog post, I’ll explore using Mach IPC messages as an attack vector to find and exploit sandbox escapes. I’ll detail how I used a custom fuzzing harness, dynamic instrumentation, and plenty of debugging/static analysis to identify a high-risk type confusion vulnerability in the coreaudiod system daemon. Along the way, I’ll discuss some of the difficulties and tradeoffs I encountered.
Transparently, this was my first venture into the world of MacOS security research and building a custom fuzzing harness. I hope
GHSA
GHSA-j4h9-xpvr-4pqq: A logic issue was addressed with improved checks
ghsa_unreviewed·2024-12-12
CVE-2024-54529 [HIGH] CWE-94 GHSA-j4h9-xpvr-4pqq: A logic issue was addressed with improved checks
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to execute arbitrary code with kernel privileges.
No detection rules found.
No public exploits indexed.
Projectzero
Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
blogs_projectzero·2026-01-30·CVSS 7.8
[HIGH] Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
coreaudiod
Iâll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success.
## The Vulnerability: A Quick Recap
If you havenât already, I highly recommend reading my detailed writeup on this vulnerability before proceeding.
com.apple.audio.audiohald
CoreAudio
coreaudiod
_XIOContext_Fetch_Workgroup_Port
HALS_Object
ioct
HALS_Object
Process 82516 stopped * thread # 8, queue = 'com.apple.audio.system-event' , stop reason = EXC_BAD_ACCESS ( code = 1, address = 0xffff805cdc7f7daf ) frame # 0: 0x00007ff81224879a CoreAudio ` _XIOContext_Fetch_Workgroup_Port + 294 CoreAudio`_XIOContext_Fetch_Workgroup_Port: 0x7ff81224879a : mov rax, qword ptr [ rdi] -> 0x7ff812248
Projectzero
Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
blogs_projectzero·CVSS 7.8
CVE-2024-54529 [HIGH] Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the `coreaudiod` system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability.
Iâll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success.
## The Vulnerability: A Quick Recap
If you havenât already, I highly recommend reading my detailed writeup on this vulnerability before procee
2024-12-12
Published