CVE-2018-4124

CRITICAL

iPhone OS < 11.2.6, macOS < 10.13.3, tvOS < 11.2.6, watchOS < 4.2.3 - Denial of Service via Telugu Character Processing

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-4124. PoCs published by jamf.

Description

An issue was discovered in certain Apple products. iOS before 11.2.6 is affected. macOS before 10.13.3 Supplemental Update is affected. tvOS before 11.2.6 is affected. watchOS before 4.2.3 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a crafted string containing a certain Telugu character.

Exploits (1)

References (6)

Core 6
Core References
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208534
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208537
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208535
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040396
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208536

Scores

CVSS v3 9.8
EPSS 0.0669
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (4)
apple/iphone_os < 11.2.6
apple/mac_os_x < 10.13.3
apple/tvos < 11.2.6
apple/watchos < 4.2.3
Published Apr 03, 2018
Tracked Since Feb 18, 2026