CVE-2024-40774 is a downgrade vulnerability affecting AppleMobileFileIntegrity on Apple platforms including iOS, iPadOS, and macOS Ventura. It allows an app to bypass Privacy preferences by exploiting insufficient code-signing restrictions. Apple addressed this issue by implementing additional code-signing restrictions and improved state management to prevent such bypasses. The vulnerability is fixed in iOS 17.6, iPadOS 17.6, and macOS Ventura 13.6.8. The affected devices include iPhone XS and later, multiple iPad Pro models, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later. The CVSS vector indicates the attack requires local access with low complexity, limited privileges, and user interaction, but can result in high confidentiality impact without affecting integrity or availability.

An app exploiting this vulnerability may bypass user-configured Privacy preferences, potentially accessing sensitive user data without proper authorization. The impact is classified as high confidentiality impact, meaning sensitive information could be exposed. However, the vulnerability requires local access with user interaction and limited privileges, reducing the likelihood of remote exploitation. There are no reports of active exploitation in the wild.

Apple has released official fixes for this vulnerability in iOS 17.6, iPadOS 17.6, and macOS Ventura 13.6.8. Users and administrators should apply these updates promptly to mitigate the risk. Since the vendor advisory confirms the issue is fixed, no additional mitigation steps are required beyond updating to the patched versions.