CVE-2018-4230

HIGH

macOS < 10.13.5 - Use-After-Free in NVIDIA Graphics Drivers via SetAppSupportBits Race Condition

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-4230. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit demonstrates a use-after-free (UAF) vulnerability in the NVIDIA GeForce driver (CVE-2018-4230) due to a race condition in the `nvDevice::SetAppSupportBits` method. The PoC uses multithreading to trigger the race, leading to a kernel panic or potential privilege escalation.

Description

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that triggers a SetAppSupportBits use-after-free because of a race condition.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdosmacos
https://www.exploit-db.com/exploits/44847

This exploit demonstrates a use-after-free (UAF) vulnerability in the NVIDIA GeForce driver (CVE-2018-4230) due to a race condition in the `nvDevice::SetAppSupportBits` method. The PoC uses multithreading to trigger the race, leading to a kernel panic or potential privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: NVIDIA GeForce driver (macOS)
No auth needed
Prerequisites: macOS system with vulnerable NVIDIA driver · Local access
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44847/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041027
Exploit, Third Party Advisory x_refsource_misc
https://bugs.chromium.org/p/project-zero/issues/detail?id=1549
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208849

Scores

CVSS v3 7.0
EPSS 0.0406
EPSS Percentile 88.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-362
Status published
Products (1)
apple/mac_os_x < 10.13.5
Published Jun 08, 2018
Tracked Since Feb 18, 2026