CVE-2018-4394

Vulnerability

A memory corruption issue exists in the AppleAVD component used for video decoding across Apple platforms. The vulnerability is triggered by processing a specially crafted video file. This issue affects iOS versions prior to 12.1, macOS Mojave prior to 10.14.1, tvOS prior to 12.1, watchOS prior to 5.1, and iTunes prior to 12.9.1 [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious video file to the target device. For example, on iOS, processing such a video via FaceTime could trigger the memory corruption [2]. The attacker does not require any special privileges; user interaction is limited to receiving and playing the video. On macOS, the attack vector may involve a remote attacker targeting AFP servers through HTTP clients, as noted in the security advisory [1].

Impact

Successful exploitation could lead to arbitrary code execution in the context of the affected application or system process. On iOS and tvOS, this may allow an attacker to execute arbitrary code with system privileges. On watchOS, a malicious application could elevate privileges [3]. The impact is a full compromise of confidentiality, integrity, and availability on the affected device.

Mitigation

Apple released fixes on October 30, 2018, as part of iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1, and iTunes 12.9.1 [1][2][3][4]. Users should update to the latest versions. No workarounds are available; updating is the only mitigation.