CVE-2024-54551 is a memory handling vulnerability classified under CWE-119 that affects Apple Safari across multiple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw occurs during the processing of web content, where improper memory management can lead to a denial-of-service (DoS) condition. Specifically, crafted web content can trigger this vulnerability remotely without requiring any user interaction or privileges, causing Safari or the underlying system to crash or become unresponsive. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an attack vector of network (remote), low attack complexity, no privileges required, no user interaction, and impact limited to availability (no confidentiality or integrity impact). Apple has remediated this issue by improving memory handling in Safari 17.6 and corresponding OS updates (iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6). No public exploits are currently known, but the vulnerability poses a risk of service disruption to users and organizations relying on Safari for web access.

The primary impact of CVE-2024-54551 is denial-of-service, which can disrupt normal browsing activities and potentially affect the availability of critical web-based applications accessed via Safari on Apple devices. For organizations, this could translate into productivity loss, interruption of business operations, and potential cascading effects if Safari is used in critical workflows or kiosk environments. Since the vulnerability can be triggered remotely without user interaction or privileges, attackers could exploit it at scale by hosting malicious web content or compromising legitimate websites to serve crafted pages. This could lead to widespread device crashes, forcing users to reboot or update devices, and potentially causing operational downtime. Although no confidentiality or integrity impacts are reported, the availability disruption alone is significant, especially in environments heavily reliant on Apple ecosystems.

To mitigate CVE-2024-54551, organizations and users should promptly update all affected Apple devices to Safari 17.6 or the corresponding OS versions (iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6) where the vulnerability is fixed. Network-level protections such as web filtering and intrusion prevention systems can be configured to block access to suspicious or untrusted websites that might host malicious content exploiting this flaw. Organizations should also educate users about the importance of applying updates promptly and consider restricting Safari usage on managed devices until patches are applied. Monitoring for unusual browser crashes or device reboots can help detect potential exploitation attempts. Finally, employing endpoint protection solutions that can detect anomalous behavior related to browser crashes may provide additional defense layers.