CVE-2024-54497 is a vulnerability in Apple’s iOS, iPadOS, and related operating systems that allows an attacker to cause a denial-of-service (DoS) condition by processing crafted web content. The root cause is insufficient validation and resource management when handling web content, which can lead to excessive resource consumption or application crashes. This vulnerability is classified under CWE-770, indicating a failure to limit resource allocation properly. The attack vector is network-based, requiring no privileges but necessitating user interaction, such as visiting a malicious website or opening a crafted web page. The vulnerability affects multiple Apple platforms, including iOS, iPadOS, macOS variants (Sequoia, Sonoma, Ventura), tvOS, visionOS, and watchOS. Apple has released patches in versions iOS 18.2, iPadOS 18.2 and 17.7.4, macOS Sequoia 15.2, Sonoma 14.7.3, Ventura 13.7.3, tvOS 18.2, visionOS 2.2, and watchOS 11.2 to address this issue by implementing improved input validation and resource checks. The CVSS v3.1 base score is 6.5, reflecting medium severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impact limited to availability. No known exploits have been reported in the wild, but the vulnerability poses a risk of service disruption on affected devices.

The primary impact of CVE-2024-54497 is denial-of-service, which can disrupt normal device operation by causing crashes or resource exhaustion when processing malicious web content. For organizations, this could lead to temporary loss of availability of critical mobile devices, potentially affecting employee productivity and access to enterprise resources. In environments where Apple devices are used for sensitive operations, such as healthcare, finance, or government, a DoS could interrupt critical workflows or emergency communications. Although the vulnerability does not impact confidentiality or integrity, the availability impact can be significant, especially if exploited at scale or targeted against key personnel. The requirement for user interaction limits large-scale automated exploitation but does not eliminate risk, as phishing or malicious web content delivery is common. The broad range of affected Apple platforms increases the scope of potential impact across diverse device types, including smartphones, tablets, desktops, smart TVs, and wearables.

Organizations should prioritize updating all affected Apple devices to the patched versions: iOS 18.2, iPadOS 18.2 and 17.7.4, macOS Sequoia 15.2, Sonoma 14.7.3, Ventura 13.7.3, tvOS 18.2, visionOS 2.2, and watchOS 11.2. Beyond patching, implement network-level protections such as web content filtering and blocking access to known malicious websites to reduce exposure to crafted web content. Educate users about the risks of interacting with untrusted web links and encourage cautious browsing behavior. Employ endpoint detection and response (EDR) solutions that can monitor for abnormal application crashes or resource usage indicative of exploitation attempts. For high-security environments, consider restricting web browsing capabilities on critical devices or using managed browsers with enhanced security controls. Regularly review and audit device inventories to ensure all systems are updated and compliant. Finally, monitor security advisories from Apple and threat intelligence sources for any emerging exploit reports or additional mitigations.