CVE-2024-40791 is a privacy-related vulnerability identified in Apple’s macOS and iOS operating systems. The root cause stems from inadequate redaction of private data in system log entries, which can allow a locally running app with limited privileges to access information about a user's contacts. This is classified under CWE-532, which relates to exposure of sensitive information through logs. The vulnerability affects multiple Apple OS versions, including macOS Ventura 13.7, Sonoma 14.7, Sequoia 15, and iOS/iPadOS 17.7 and 18. The CVSS v3.1 base score is 3.3, reflecting low severity due to the requirement for local access (AV:L), low attack complexity (AC:L), and the need for privileges (PR:L) but no user interaction (UI:N). The impact is limited to confidentiality, with no effect on integrity or availability. Apple has addressed this issue by improving private data redaction in log entries, preventing unauthorized apps from extracting contact information. There are no known exploits in the wild, and the vulnerability does not appear to be actively targeted. The fix is included in the latest OS updates, and users are advised to upgrade to these versions to mitigate the risk.

For European organizations, the primary impact of CVE-2024-40791 is the potential unauthorized disclosure of user contact information, which could lead to privacy violations and data protection compliance issues under regulations such as GDPR. Although the vulnerability requires local access and privileges, insider threats or compromised endpoints could exploit this to harvest contact data. This could facilitate social engineering, phishing campaigns, or unauthorized profiling. The low severity and lack of known exploits reduce immediate risk, but organizations with sensitive contact databases or those in regulated sectors should consider this a privacy concern. The impact on operational continuity or system integrity is negligible. However, failure to patch could result in reputational damage and regulatory penalties if contact data is exposed.

European organizations should ensure all Apple devices are updated to the patched OS versions: macOS Ventura 13.7 or later, macOS Sonoma 14.7, macOS Sequoia 15, and iOS/iPadOS 17.7 or 18. Implement strict endpoint security controls to limit local privilege escalation and prevent unauthorized app installations. Use Mobile Device Management (MDM) solutions to enforce update policies and monitor device compliance. Restrict access to sensitive contact information through application permissions and audit logs for unusual access patterns. Educate users about the risks of installing untrusted applications. Regularly review and harden logging configurations to avoid inadvertent exposure of sensitive data. Conduct internal audits to detect any unauthorized access to contact information. Finally, maintain an incident response plan that includes privacy breach scenarios.