CVE-2018-4368

Vulnerability

A denial of service issue exists in the AppleAVD component of Apple's AVFoundation framework, affecting versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, and watchOS 5.1. The vulnerability is an input validation issue that can be triggered by processing malicious video content via FaceTime [2]. The official description states that the issue is addressed with improved validation [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted video stream or file that, when processed by the AVFoundation decoder (AppleAVD), causes an unexpected condition. The attack vector is remote, requiring no authentication, and can be delivered through a FaceTime call or by persuading a user to play a malicious video file. No user interaction beyond receiving the call or playing the file is required [2].

Impact

Successful exploitation leads to a denial of service, potentially causing the affected application or the entire system to crash. This disrupts availability but does not provide code execution or data compromise. The impact is limited to denial of service, as per the CVE description [1][2].

Mitigation

Apple released fixes on October 30, 2018, as part of iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, and watchOS 5.1. Users should update to these versions or later. No workarounds are documented; updating is the only mitigation [1][2][3][4].