CVE-2024-23297 is a privacy-related vulnerability in Apple iOS and iPadOS that could allow a malicious application to read restricted memory. The root cause was a validation issue that has been mitigated by improved input sanitization in the security updates released in iOS 17.4 and iPadOS 17.4. The vulnerability has a CVSS 3.1 base score of 5.5, with attack vector local, low complexity, low privileges required, no user interaction, and impact on confidentiality only. Apple’s official advisories confirm the fix and recommend updating to the latest OS versions.

A malicious application with local access and low privileges could exploit this vulnerability to read private information from restricted memory areas on affected Apple devices. This could lead to unauthorized disclosure of sensitive user data. The vulnerability does not impact integrity or availability. There are no known exploits in the wild at this time. The medium CVSS score reflects the potential confidentiality impact without elevation of privileges or remote exploitation.

Apple has released official patches for this vulnerability in iOS 17.4 and iPadOS 17.4. Users and administrators should update affected devices to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official update. Patch status is confirmed by Apple’s security advisory.