CVE-2024-40789

Overview

Medium

Severity

6.5

CVSS

No

Exploited ITW

Embargoed

Fix Status

DescriptionProcessing maliciously crafted web content may lead to an unexpected process crash

ComponentWebKit

Bug ClassOOB

CWECWE-125 (Out-of-bounds read)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA KEVNot listed

CreditedSeunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro Zero Day Initiative

Disclosed2024-07-29

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.

Original Bug Report

The reporter's bug is still restricted on the tracker.

References

Vendor advisory NVD