CVE-2015-3706

Vulnerability

A memory corruption vulnerability exists in the IOAcceleratorFamily component of Apple OS X. The bug is reachable when a crafted application interacts with the iOS Accelerator framework. All versions of OS X before 10.10.4 are affected, including OS X Mavericks v10.9.5 and OS X Yosemite v10.10 through v10.10.3 [1].

Exploitation

An attacker must first persuade the user to run a maliciously crafted application. No additional authentication or network access is required beyond the local ability to execute the app. The crafted app triggers memory corruption in IOAcceleratorFamily by sending specially crafted inputs to the framework [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in a privileged kernel context or cause a denial of service via memory corruption. This can lead to full compromise of the system, including the ability to install malware, modify system files, or access protected data [1].

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.4, released on June 30, 2015. Users should update to this version or later via Software Update or Apple's security update website [1]. No workarounds were published.